How does MFA work?

During an MFA-protected login, a user first supplies a primary credential, most commonly a password, and the system then requests one or more additional, independent factors before granting access.

A typical MFA sequence:

• Step 1, primary credential: The user enters a password or PIN.
• Step 2, additional factor: The user confirms their identity through a one-time code, a push notification approval, a hardware security key, or a certificate stored on a device.
• Step 3, verification: The system checks that all required factors have been successfully verified before granting access.
• Step 4, access decision: Access is only granted once every required factor has passed verification; failure at any stage blocks the login.

Because access depends on multiple independent checks rather than a single shared secret, even if one factor, such as a password, is exposed through a data breach or phishing attempt, an attacker still cannot complete authentication without the additional factor as well.