# How Multi-Factor Authentication Protects Online Accounts Source: https://urbanx.co.za/knowledge-hub/digital-safety-privacy-account-protection/multi-factor-authentication-account-protection **Answer:** MFA requires more than one independent factor before access is granted. A stolen password alone is therefore insufficient. Any suitable MFA is commonly better than password-only access, but manually entered codes and push prompts can still be phished. Passkeys and physical security keys offer stronger phishing resistance when properly deployed. Part of [Digital Safety, Privacy & Account Protection](https://urbanx.co.za/knowledge-hub/digital-safety-privacy-account-protection) · 10 min read · by UrbanX Knowledge Hub **Last reviewed: 26 August 2026 · 10 min read** ### What counts as a factor? Authentication factors are commonly grouped as: - **Something you know:** password or PIN. - **Something you have:** phone, authenticator app, security key or authorised device. - **Something you are:** biometric used to unlock a local authenticator. Two passwords are not two factors because both are knowledge. A password plus SMS code uses knowledge and possession, although the possession factor has limitations. ### How MFA stops a common attack Without MFA: `Stolen password → Account access` With MFA: `Stolen password → Second factor still required` This blocks many credential-stuffing and password-reuse attacks. It also creates an alert when a login prompt arrives that the user did not initiate. ### MFA methods are not equivalent #### SMS code Widely available and better than password-only access in many situations. Risks include real-time phishing, SIM-swap attacks, message interception and loss of the number. #### Email code Convenient, but its security depends on the email account. If the same mailbox controls password reset and MFA, compromise can defeat both. #### Authenticator-app code Generated locally and independent of mobile delivery. The code can still be entered into a phishing site and relayed. #### Push approval Convenient, especially when it shows device, location and number matching. Repeated prompts can cause fatigue, and a user can approve an attack by mistake. #### Security key or passkey Uses cryptographic authentication bound to the genuine service. This prevents the user from giving a reusable code to a lookalike domain and is considered phishing-resistant when implemented correctly. ### Choose the strongest practical option If the service offers several choices, a general preference is: 1. Passkey or FIDO security key. 2. Authenticator with phishing-resistant or number-matching features where available. 3. Authenticator code. 4. SMS or email code when stronger options are unavailable. The exact order depends on the service, device, risk and recovery model. Enabling SMS MFA is usually better than postponing all MFA while waiting for a perfect method. ### Protect the recovery path Attackers may bypass strong daily sign-in by targeting account recovery. Review: - recovery email; - mobile number; - backup codes; - security questions; - trusted devices; - customer-support identity checks; and - linked accounts that can sign in. A dormant recovery mailbox with a reused password can undermine a well-protected primary account. ### Store backup codes deliberately Backup codes are often single-use secrets that bypass the normal second-factor device. Keep them: - offline in a secure physical location; or - inside a separately protected vault with suitable access controls. Do not save the only copy on the phone they are meant to replace. Never share a backup code with support or a caller. ### Recognise MFA attacks #### Prompt bombing An attacker with the password triggers repeated approvals, hoping the user accepts one to stop the interruptions. #### OTP relay A fake site captures the password and current code, then uses both immediately on the real site. #### Support impersonation A caller says the code will cancel an attack when it actually approves access. #### SIM swap Stolen personal information is used to move a number to another SIM, allowing the attacker to receive SMS codes. #### Recovery downgrade The attacker persuades support to replace a strong factor with a weaker one. The response is the same: do not approve an unrequested event, change the exposed password through the genuine site and review sessions and recovery settings. ### Set up MFA without locking yourself out 1. Start with primary email and the password manager. 2. Add the strongest supported factor. 3. Register a second authenticator where supported. 4. Generate and store backup codes. 5. Confirm the recovery email and number. 6. Test sign-in on a normal second device. 7. Remove obsolete phone numbers and devices. 8. Record how to contact official recovery support. Do not disable the last working factor until the replacement is tested. ### Respond to an unexpected prompt - Deny it. - Do not share the displayed code. - Open the service independently. - Change the password if it may be known. - Review recent sign-ins and authorised devices. - Remove unknown sessions. - check whether recovery information changed. - Report the attempt through the platform’s security flow. If financial or identity information is at risk, contact the relevant institution immediately. ### Sources - [CISA: Turn On MFA](https://www.cisa.gov/secure-our-world/turn-mfa) - [CISA: More Than a Password](https://www.cisa.gov/MFA) - [CISA: Phishing-Resistant MFA Is Key](https://www.cisa.gov/news-events/news/phishing-resistant-mfa-key-peace-mind) - [NIST Digital Identity Guidelines: Authentication](https://pages.nist.gov/800-63-4/sp800-63b.html) - [FIDO Alliance Passkeys](https://fidoalliance.org/passkeys/) ### Related guides - [All Digital Safety, Privacy & Account Protection guides](/knowledge-hub/digital-safety-privacy-account-protection) - [Passkeys vs Passwords vs One-Time PINs](/knowledge-hub/digital-safety-privacy-account-protection/passkeys-vs-passwords-vs-otp) - [Password Managers: Why Reusing Passwords Is Risky](/knowledge-hub/digital-safety-privacy-account-protection/password-managers-password-reuse-risk) - [What to Do After an Online Account Is Hacked](/knowledge-hub/digital-safety-privacy-account-protection/what-to-do-account-hacked) ## Frequently Asked Questions **Is two-step verification the same as MFA?** The terms are often used together, although two steps are not always two independent factor types. The service’s actual method matters. **Is SMS MFA useless?** No. It can block password-only attacks. It is less phishing-resistant and more exposed to phone-number compromise than stronger methods. **Should I approve a prompt to make it stop?** No. Deny unrequested prompts, then secure the account through the genuine app or site. **Can a support agent ask for my OTP?** Do not disclose a live authentication or payment code to someone who contacted you. Verify through the organisation’s official channel. **What account should get MFA first?** Start with the primary email and password manager because they can recover many other accounts, then protect banking, cloud, social and gaming accounts.