Multi-factor authentication
MFAAlso called two-factor authentication (2FA), multifactor authentication
Multi-factor authentication is a login control that requires two or more independent factors before granting access: something the user knows, such as a password; something they have, such as a phone or token; or something they are, such as a fingerprint. Stealing one factor alone is not enough to get in.
How it works
When a user signs in, the system checks a first factor, usually a password, then asks for a second from a different category. Common second factors are a code from an authenticator app, a push approval on a registered phone, a hardware security key or a biometric check. Phishing-resistant methods, such as hardware keys and passkeys, bind the login to the genuine site so stolen codes cannot be replayed.
Regulators now expect MFA for staff and systems as a baseline control. Financial firms apply it to remote access, privileged accounts, email and cloud services, and any system holding customer data. Weak spots include SMS codes, which can be intercepted through SIM swaps, and push fatigue attacks, where users approve repeated prompts. Firms monitor failed attempts and resets, which attackers target through help desks.
The rules
Requires MFA for any individual accessing any information system, unless the CISO approves equivalent or more secure controls in writing.
Banks, insurers and other entities licensed by NYDFSRequires MFA for any individual accessing any information system, unless the qualified individual approves equivalent or more secure controls in writing.
Non-bank financial institutions under FTC jurisdictionSets supervisory expectations for risk-based authentication, naming MFA as an effective control for customers, employees and third parties.
US banks and credit unionsRequires strong authentication for remote network access, privileged access, and ICT assets supporting critical or important functions or publicly accessible.
EU financial entities under DORACommon questions
Is MFA the same as two-factor authentication?
Two-factor authentication is MFA with exactly two factors. MFA covers two or more. Both only count when the factors come from different categories, so a password plus a security question is not MFA.
What is the difference between MFA and strong customer authentication?
Strong customer authentication is the EU and UK payments rule requiring two-factor checks for customer payments and account access. MFA is the wider security control, applied to staff, systems and customers.
Are SMS codes good enough for MFA?
They count as a factor under most rules, but regulators and security bodies class them as weaker. Attackers can intercept them through SIM swaps or phishing, so firms prefer app-based, hardware key or passkey methods for sensitive access.
