Secordit home
Contact

What is multi-factor authentication (MFA)?

In cyber security, MFA means signing in with more than one check, not only a password. It is also called two-step verification (2SV) or two-factor authentication (2FA). The extra check may be a code, a device prompt, or a passkey. MFA still helps if a password is stolen, but not every method is equally strong. 134

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. You enter your password, or start sign-in on a service that supports a passkey. 12
  2. The service asks for a second check. That may be a code from an app, a text or email, a prompt on a trusted device, or a passkey or security key. 13
  3. A code sent by text or email is weaker than an app or a passkey, and can be intercepted or phished. 34

How it can look

The NCSC tells people to turn on 2-step verification for important accounts. That includes email, banking, social media and shopping, and any password manager. Where a service offers passkeys, the NCSC currently recommends those first. Use a strong unique password plus 2SV where passkeys are not available. 12

Warning signs

  • Someone calls, texts or messages you and asks you to read out or forward a sign-in code. 4
  • You get a sign-in prompt or code you did not request. 42
  • A service still offers only a password, with no second check and no passkey. 12

What to do now

  1. Turn on MFA, 2SV or a passkey for email, banking, social media, shopping, and any password manager. 12
  2. Prefer a passkey or an authenticator app over a code sent by text or email, where the service offers that choice. 34
  3. If someone asks you to share a code or approve a prompt you did not request, stop and use a contact method you already trust. See also the one-time passcode scam page. 4

UK reporting and support

  • If you think an account has been taken over, follow the NCSC guidance on recovering a hacked account. Change the password through the genuine site. 5
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 689
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 7
  • If someone is in danger, call 999. 89

How to protect yourself

  • Use a different strong password for every account, ideally with a password manager, alongside MFA or a passkey. 12
  • Turn it on for important accounts first, especially email, because email is often used to reset other logins. 1
  • Treat an unexpected code request as a warning sign, even if the caller sounds like your bank or a colleague. 4

Frequently asked questions

Is 2FA the same as MFA, and which should I turn on for my email and bank?

The NCSC uses 2SV, 2FA and MFA as everyday names for the same idea: signing in with more than a password. Turn it on for email and banking. Choose a passkey or an app-based check where the service offers one. 13

Does MFA stop every attack?

No. MFA still helps if a password is stolen, but some attacks trick people into approving a prompt or handing over a code. The NCSC is clear that not all MFA types are equally strong. 43

Is MFA the same as a Master of Fine Arts degree?

No. In this glossary, MFA means multi-factor authentication, a way of signing in. The same letters are also used for a Master of Fine Arts degree, which is a different subject. 1

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Turn on 2-step verification (2SV) | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, Setting up 2-Step Verification (2SV) | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Recommended types of MFA | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. NCSC, Not all types of MFA are created equal | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  5. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  6. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  7. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  8. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  9. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).