Skip to content
Akademia
Book a demo

MFA and two-step verification: what it is and what every employee needs to know

What is MFA and how is it different from 2FA? Methods from SMS to passkeys, attacker tricks like push bombing and fake bank calls, and rules for all staff.

ZeroLayer Team 13 min read

A smartphone showing a sign-in approval request and a hardware security key on a dark navy desk in cool turquoise light

MFA (multi-factor authentication) is a way of signing in where, in addition to your password, you have to provide a second, independent proof that it is really you: a code from an app, an approval on your phone or a hardware key. This means a stolen password alone is not enough to take over the account. In this guide we explain how MFA differs from 2FA and two-step verification, which methods are stronger, how attackers try to get around them and what rules every employee should know, from reception to the management board.

What is MFA and how does it differ from 2FA and two-step verification

These three terms are used interchangeably, although they differ in the details.

  • MFA (multi-factor authentication) is the broadest term. The US agency CISA defines it as a requirement to present at least two different factors from three categories: something you know, something you have or something you are.
  • 2FA (two-factor authentication) is the most common type of MFA: exactly two factors, usually a password and a phone.
  • Two-step verification is the name popular in Polish services and materials, including those of CERT Polska, which describes it as a sign-in process made up of a password or PIN and a second factor, such as a one-time code, an approval in an app or a USB key.

Formally, two steps do not always mean two different factors (two passwords in a row are still one factor), but in practice "turn on MFA" at work and "two-step verification" at your bank mean the same thing: a password alone is no longer enough.

Microsoft researchers analysed business accounts with suspicious activity and estimated that MFA reduces the risk of account compromise by 99.22%, and by 98.56% for accounts with a leaked password. That is why attackers prefer to talk you into handing over the second factor.

99.22%
reduction in the risk of account compromise thanks to MFA in the studied group of business accounts
Microsoft Research, 2023
13%
of breaches began with credential abuse, which a year earlier was the most common entry point
Verizon, DBIR 2026
93%
of passkey sign-ins succeed, compared with 63% for other methods
FIDO Alliance, Passkey Index 2025

Three types of factor: knowledge, possession, inherence

  1. Something you know: a password, PIN or answer to a question.
  2. Something you have: a phone with an app, a card, a hardware key.
  3. Something you are: a fingerprint, your face.

The factors must come from different groups. A password can be phished by email, but to sign in the attacker still needs your phone or key. That is why you should never give anyone what you "have", even in the form of six digits read out over the phone. Biometrics usually just unlock the device where the actual factor is stored.

MFA methods from weakest to strongest

In its material on phishing-resistant MFA, CISA ranks methods from weakest to strongest and stresses that any form of MFA is better than none. Below is the same order, described from the perspective of the person signing in.

MethodWhat you doWhat to watch out for
SMS code or voice callyou type in the code from the messagethe code can be intercepted or phished, the number can be hijacked (SIM swap)
Push notification without a numberyou tap "Approve" in the appit is easy to approve someone else's sign-in by mistake
Code from an authenticator appyou type in a code that changes every few dozen secondsthe code can be entered on a fake page
Push with number matchingyou enter on your phone the number shown on the sign-in screenprotects against notification flooding, but not against a fake page
Passkey or FIDO2 hardware keyyou unlock your phone or laptop, or touch the keyresistant to fake pages; look after the device itself

SMS and voice calls

This is the weakest form of MFA. CISA points to two problems: attackers can exploit weaknesses in the telecoms network (the SS7 protocol) to intercept the code, or persuade the mobile operator to transfer your number to their SIM card. In its SP 800-63B guidelines from 2025, the US NIST still classifies SMS and voice calls as a restricted method. If a service lets you choose between SMS and an app, choose the app.

Push, app codes and number matching

A plain push ("Is this you signing in?") is easy to approve on autopilot while you are doing something else. An app code does not depend on the mobile operator, so it is not at risk from number hijacking, but it can still be entered on a fake page. With number matching, the sign-in screen shows a number and you enter it in the app. CISA recommends this as protection against notification flooding. For you, it means one simple rule: if your phone asks you to enter a number and you are not looking at a sign-in screen right now, you have no way of knowing it. That means someone else is signing in.

Passkeys and FIDO2 hardware keys

The strongest group, which CISA calls the "gold standard". A fake page impersonating your work email will not get anything from your device that it could use. Details are in the passkey section below.

How attackers get around MFA and what it looks like from your side

Instead of breaking MFA, attackers try to get you to open the door for them. According to the Verizon DBIR 2026 report, credential abuse as an entry point fell to 13% of breaches, while pretexting, a made-up story often carried out over the phone, is increasingly opening the way to ransomware and extortion attacks. We write more about manipulation techniques in the article on social engineering.

A series of notifications you did not trigger (MFA fatigue)

CISA describes "MFA fatigue", also known as push bombing: someone knows your password and triggers dozens of approval requests in a short time. They are hoping that you will eventually tap to make it stop, by mistake, or in the belief that one of the requests is genuine. The attacker may also message or call you: "This is IT, we're testing the system, please approve the notification."

What it looks like from your side: late in the evening or at the weekend, your phone vibrates several times in a row even though you are not opening anything. There is only one conclusion: someone knows your password.

A fake page that relays the code in real time

An email about a shared document leads to a page that looks like the sign-in page for your work email. You enter your password and code or approve a push, and at the same time the attacker passes everything on to the real service and takes over your session. From your perspective, the sign-in "worked" or a strange error appeared.

Neither a code nor a plain push protects against this. What helps is checking the page address, and best of all a passkey or FIDO2 key. A technical description of these attacks, together with a comparison of what each method actually stops, can be found in our analysis of a campaign targeting senior executives.

A call "from the bank" or "from IT" asking for a code

Someone calls about a "suspicious sign-in" and asks for the code from the text message you are about to receive. That code does not verify you. It signs the fraudster into your account or approves their transaction. The Polish Ministry of Digital Affairs reminds people that an employee of a bank or any other institution will never ask for passwords or access codes, and that the number on the display can be faked.

Phone number hijacking (SIM swap)

The fraudster convinces the mobile operator that the SIM card has been lost and gets a duplicate, and with it your text messages with codes. From your side it looks like this: your phone suddenly loses signal, even though people around you still have it. In that case, contact your operator and the IT department straight away.

MFA rules for every employee

These rules are worth repeating until they become second nature. A shorter version, as one of 12 rules, can be found in the guide cyber hygiene at work.

Never approve a sign-in you did not start

If you did not start the sign-in, there is nothing to approve. If the notification shows the location or name of the app signing in and the details do not match, deny it as well.

Do not give codes to anyone

A one-time code is like a key to your flat that works for one minute. Do not pass it on by phone, chat or email, including to someone claiming to be from IT, your manager or the bank. The IT department has its own tools and does not need your code.

After a series of notifications: deny, report, change your password

The order matters. Deny every notification, report the issue through your company's reporting channel and change the password for that account, and if the same password works elsewhere, change it there too. Do not wait until the morning: an attacker who knows the password may try another route, for example calling the helpdesk to ask for an MFA reset. For the same reason, report immediately any messages about a new device being added, a phone number being changed or an MFA reset that you did not request. How to set up passwords so that a leak from one service does not open others is described in the article on secure passwords at work.

Lost phone or key: report it straight away

Report the loss of a phone with an authenticator app to IT on the same day, so the device can be removed from your accounts. When you change phones, move MFA to the new one first and only then wipe the old one, otherwise you may lose access.

Keep backup codes offline

Many services provide one-time backup codes in case you lose your phone. CERT Polska advises printing them or saving them on external media and keeping them in a safe place. Do not keep them in a note on the same phone or in the mailbox they protect. For work accounts, ask IT what the access recovery procedure is before you need it.

Passkeys: what they are and how they work at work

A passkey is a way of signing in based on FIDO standards. The FIDO Alliance describes it as a credential stored on your phone, computer or hardware security key, which you unlock the same way you unlock the device: with a PIN, fingerprint or face.

In practice it looks like this: you enter your email address, the system asks you to confirm, and you put your finger on the laptop's reader or touch the USB key. You do not type in any code, so there is nothing to phish. The passkey is tied to a specific service, which is why a fake page with a similar address will not get a response it could use. This is the phishing resistance that CISA and NIST rank highest. In its 2025 guidelines, NIST requires services at the higher assurance level (AAL2) to offer at least one such option.

Passkeys come in two types:

  • Synced between your devices through the provider's account. They are convenient because they work on a new phone without setting them up again.
  • Bound to a single device, for example a FIDO2 hardware key. The FIDO Alliance points out that they provide the highest level of assurance, so they suit administrator accounts and the most sensitive systems.

Passkeys are also simply faster. In the FIDO Alliance index from October 2025, signing in with a passkey took an average of 8.5 seconds, compared with 31.2 seconds for methods such as an SMS code or email verification. If your company allows passkeys for your work account, it is worth adding one, but always following the IT department's instructions, not a link from an email.

Look after the device where your passkey is stored, and report a lost hardware key the same way you would a lost phone.

How to practise MFA as a team

MFA rules seem obvious until someone gets their fifth notification at 11 pm. It is better to practise them when things are calm:

  • A check question at a meeting (5 minutes). "Your phone vibrates three times while you're watching a film. What do you do?" and "'IT' calls and asks for the six digits from a text message. What do you say?"
  • A phone role-play in pairs (10 minutes). One person plays a "consultant" who pushes for the code, the other practises politely ending the call and calling back on a known number.
  • A sign-in screen demo (5 minutes). Show the number matching prompt in your system and say it plainly: without a sign-in screen in front of you, there is no way to know the number.
  • A backup code check (15 minutes). Everyone checks whether they have backup codes and where they keep them, and IT goes over the procedure for a lost phone.
  • Spotting a fake sign-in page. A phishing simulation with a link to "sign in to email" shows who checks the address before entering their password and code.

Record the results: the number of reports and the response time will tell you more than an attendance list. If your organisation is covered by the KSC Act, these records will be useful as evidence of staff education, which we write about in the article on NIS2 and KSC training. The technical side, that is the limits of how effective the second factor is, is covered in the article on protecting against credential stuffing.

How it works in ZeroLayer Academy

In ZeroLayer Academy, MFA rules and recognising attempts to phish codes are part of a series of remote training sessions: video micro-lessons, games and quizzes. Phishing simulations modelled on real campaigns show who stops before handing over their details, and employees finish the course with a numbered certificate. The manager's dashboard shows progress and generates training reports, and the onboarding path covers new starters from day one. You will find the list of topics in the training topics section, and the available options, including a free 30-day pilot for one department, in the Options section.

FAQ

What is MFA in simple terms?

MFA, or multi-factor authentication, is a way of signing in where, in addition to your password, you confirm your identity in a second way, for example with a code from an app, an approval on your phone or a hardware key. A password alone is then not enough to take over the account.

How is 2FA different from MFA and two-step verification?

MFA is the general term: at least two factors from different groups (knowledge, possession, inherence). 2FA is MFA with exactly two factors, usually a password and a phone. Two-step verification is the name used by CERT Polska, among others, for the same mechanism: a password and a second step, such as a code or an approval in an app.

Is an SMS code secure two-step verification?

It is much better than a password alone, but it is the weakest form of MFA. CISA points out that SMS codes can be intercepted through weaknesses in the telecoms network or taken over along with the phone number (SIM swap). If the service allows it, choose an authenticator app, a passkey or a hardware key.

What should I do if I get MFA notifications I did not trigger?

Deny every one of them, report the issue to the IT department through your company's reporting channel and change the password for that account. A series of such notifications means someone knows your password and is hoping you will eventually approve the sign-in out of fatigue or by mistake.

What is a passkey and will it replace passwords?

A passkey is a sign-in method based on FIDO standards, stored on a phone, computer or hardware key and unlocked with a PIN or biometrics. It is tied to a specific service, so a fake page cannot use it. At work, add one following the IT department's instructions.

What should I do after losing a phone with an MFA app?

Report the loss to the IT department on the same day so the device can be removed from your work accounts, and for personal accounts sign in with backup codes and remove the old device. If your SIM card is also lost, block it with your mobile operator.

Sources

Read next