MFA combines multiple authentication factors:
Something you know: Password, PIN
Something you have: Phone, hardware key
Something you are: Fingerprint, face
Implementation patterns:
-
TOTP: Time-based one-time passwords (Google Authenticator). Server and client share secret, generate matching codes.
-
SMS/Email: Send code to verified contact. Weaker due to SIM swapping and email compromise.
-
Push notification: User approves on trusted device.
-
Hardware keys: FIDO2/WebAuthn. Strongest option, phishing-resistant.