What Is MFA? Multi-Factor Authentication Explained | AP Cybersecurity
What Is Multi-Factor Authentication (MFA)? Factors, Examples & Limits
Multi-factor authentication (MFA) requires two or more independent factors to log in, so a stolen password alone is not enough. It is the single most effective upgrade to a login, but it is not unbreakable.
Contents
The three factor categories
MFA combines factors from different categories: something you know (a password or PIN), something you have (a phone, security key, or authenticator app), and something you are (a fingerprint or face).
The strength comes from using different categories. Two passwords are not MFA, because both are 'something you know.' A password plus an app code is MFA, because it mixes 'know' and 'have.'
A site asks for a password and then a second password as a 'security question.' Is this true MFA?
Reveal answer
No. Both are 'something you know.' True MFA combines different factor categories, such as a password plus a device-based code.
If the two factors come from the same category, it is not multi-factor. Check that the categories differ (know, have, are).
Why MFA still has limits
MFA stops attackers who only have your password. But a one-time passcode is a credential too. If a social engineer convinces you to read it aloud or type it into a fake site, they can use it before it expires.
This connects back to social engineering: the framework lists a one-time passcode as a stealable credential (EK 1.1.C.2). MFA raises the bar; human verification habits still matter.
An attacker has a user's password and calls pretending to be IT, asking for the texted code. The user reads it aloud. Does MFA help?
Reveal answer
Not in this case. The user handed over the second factor. MFA defeats a stolen password alone, but not a user who shares the one-time code.
The 2022 Uber breach
An attacker who already had an employee's password sent repeated MFA prompts and then posed as IT to get one approved (MFA fatigue), gaining access even though MFA was enabled.
MFA is strong, but a socially engineered approval defeats it.
Key Terms
| Multi-factor authentication | Two or more independent factors from different categories. |
| Factor | A category of proof: something you know, have, or are. |
| One-time passcode | A short single-use code that counts as a credential, so never share it. |
| Authenticator app | An app that generates time-based codes as a have factor. |
Match It Up
Common Mistakes
Calling two passwords 'MFA'
Two factors from the same category (both 'know') is not multi-factor. The categories must differ.
Believing MFA stops all attacks
A phished one-time code can still defeat MFA. It is strong, not absolute.
Confusing a one-time code with 'not a credential'
A one-time passcode is a credential. Never share it.
Thinking biometrics are flawless
'Something you are' is strong but can be spoofed; it is still best combined with another factor.
Check for Understanding
Frequently Asked Questions
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]