Multi-factor authentication (MFA) is a login method that requires two or more different types of proof of identity, such as a password plus a phone or security key. It stops most password attacks, yet device-code phishing obtains sessions with MFA already satisfied and fake browser windows harvest MFA-protected sessions.
