MFA (Multi-factor Authentication)
A security method requiring 2+ verification factors (password + OTP/biometric) to access resources.
What is MFA (Multi-factor Authentication)?
Multi-factor Authentication (MFA) is a security mechanism that requires users to provide two or more independent verification factors to gain access to applications, user accounts, or networks. MFA is a critical component of modern CIAM (Customer Identity and Access Management) architectures.
MFA significantly reduces the risk of account takeover (ATO) by requiring additional proof beyond just passwords, which can be phished, guessed, or breached in data leaks.
The three standard authentication factors are:
- Knowledge factor (something you know): Password, PIN, security questions
- Possession factor (something you have): Smartphone (TOTP app), hardware token (YubiKey), SMS OTP
- Inherence factor (something you are): Biometrics (fingerprint, FaceID, iris scan)
In CIAM implementations, MFA is typically enforced for:
- High-value transactions (banking, healthcare, enterprise)
- Administrative access (admin panels, APIs)
- Compliance requirements (PSD2, HIPAA, SOC 2)
- After suspicious login attempts (new device, new location)
Technical note for engineers: MFA should be implemented at the identity provider (IdP) level (like LoginRadius) rather than individual applications, enabling centralized policy enforcement, audit logging, and consistent user experience across all connected applications.
Analogy
Think of MFA like a house with two locks - even if someone steals your key (password), they still can't get in without the second lock (your phone with OTP). It's like having both a password AND a physical key to enter.
Types and Use Cases
Types of MFA in CIAM:
- TOTP (Time-Based One-Time Password): Google Authenticator, Authy, Microsoft Authenticator - 6-digit codes that change every 30 seconds (RFC 6238)
- SMS/Email OTP: One-time codes sent via SMS or email - convenient but vulnerable to SIM swapping (SMS) and phishing (email)
- Push Notification: Authy, Duo, Microsoft Authenticator - user approves/denies login directly on their phone
- FIDO2/WebAuthn (Passkeys): YubiKey, FaceID, Windows Hello - phishing-resistant hardware/biological factors
- Backup Codes: Pre-generated one-time use codes for account recovery when primary MFA device is unavailable
CIAM Use Cases:
- Consumer Banking: Enforce MFA for transfers >$500, password changes, and new payee additions
- Healthcare Portals: Require MFA for accessing patient records (HIPAA compliance)
- Enterprise B2B: Employees accessing partner portals, vendor dashboards with TOTP or FIDO2
- E-commerce: Step-up authentication for checkout, saved payment methods, and order history access
- Compliance-Driven: PSD2 Strong Customer Authentication (SCA) for EU customers, SOC 2 for enterprise
How it Works
{
"auth_flow": "mfa_verification",
"user_id": "usr_8f3a2b1c9d",
"step_1": {
"type": "password",
"status": "verified",
"timestamp": "2026-05-06T14:32:15Z"
},
"step_2": {
"type": "totp",
"factor": "posession",
"code": "123456",
"status": "verified",
"method": "authy_app",
"timestamp": "2026-05-06T14:32:45Z"
},
"session": {
"mfa_verified": true,
"mfa_method": "totp",
"access_token_issued": true
}
}MFA (Multi-factor Authentication) vs 2FA (Two-Factor Authentication)
MFA (Multi-factor Authentication)
2FA (Two-Factor Authentication)
MFA requires 2+ factors (password + TOTP + biometric)
2FA is specifically 2 factors only (usually password + OTP)
MFA is the broader category that includes 2FA plus additional factors (3FA, adaptive MFA with risk scoring)
In CIAM, 2FA typically refers to password + OTP (basic)
MFA can include adaptive policies (IP, device, behavior analysis)
2FA is often user-initiated (optional)
MFA in enterprise CIAM is often policy-enforced (mandatory for certain actions)
MFA includes adaptive/risk-based authentication (step-up only when suspicious)
2FA is always on (no risk assessment)
Best Practices for MFA (Multi-factor Authentication)
CIAM Best Practices for MFA Implementation:
- Prefer FIDO2/WebAuthn for phishing resistance: TOTP codes can be phished (user enters code on fake site); FIDO2 binds to origin (cannot be phished) - use YubiKey/FaceID for admin accounts
- Implement adaptive MFA: Don't always require MFA (bad UX) - use risk scoring (new device, new location, impossible travel) to trigger step-up authentication only when needed
- Offer multiple MFA options: Don't force only SMS (SIM swapping risk) - provide TOTP app, backup codes, and FIDO2 as alternatives
- Plan for account recovery: 15-20% of users lose MFA device - provide backup codes, secondary email, or support-driven identity verification process
- Educate users on phishing: TOTP users need to understand they should never enter codes on non-official sites; consider push notification MFA (harder to phish) for less technical users
How LoginRadius Powers MFA (Multi-factor Authentication)
LoginRadius CIAM platform provides comprehensive MFA support for consumer and B2B identity scenarios, enabling organizations to enforce strong authentication without sacrificing user experience.
Supported MFA Methods:
- TOTP (RFC 6238): Users scan QR code during enrollment, generate 6-digit codes with Authy/Google Authenticator apps
- SMS & Email OTP: Automatic code delivery via Twilio/SendGrid integration, configurable expiration (5-15 minutes)
- FIDO2/WebAuthn: Hardware keys (YubiKey) and platform biometrics (FaceID, Windows Hello, Android fingerprint) for phishing-resistant MFA
- Security Questions: Customizable questions for fallback authentication when primary MFA methods unavailable
Advanced MFA Features:
- Adaptive/risk-based MFA: Configure policies based on IP reputation, device fingerprint, geo-location, and login frequency to trigger step-up only when risk is detected
- Bypass codes: Time-limited backup codes for users who lose MFA device (downloadable during enrollment)
- MFA enforcement policies: Per-application, per-user-group, or per-action (require MFA for password changes, payments >$X, admin access)
- Audit & compliance: All MFA events logged with timestamp, IP, device fingerprint, and method used (SOC 2, ISO 27001 compliant)
Recommendation: Use LoginRadius's FIDO2 support for strongest security (phishing-resistant), TOTP for broad compatibility, and SMS only as last-resort backup.
FAQs
- 2FA (Two-Factor Authentication) is a subset of MFA (Multi-Factor Authentication) - 2FA = exactly 2 factors; MFA = 2 or more factors
- 2FA in CIAM typically means password + OTP (SMS or TOTP app); MFA can include additional factors like biometrics, security questions, or device certificates
- MFA includes adaptive authentication (risk-based) - only trigger MFA when login looks suspicious (new device, VPN, geo-location mismatch); 2FA is "always on"
- Implementation difference: 2FA is simpler (password + OTP); MFA can have complex policies (require FIDO2 for admins, TOTP for users, SMS only for recovery)
- SMS OTP is the least secure MFA method - vulnerable to SIM swapping attacks (attacker transfers victim's phone number to their SIM)
- NIST no longer recommends SMS for out-of-band authentication (NIST SP 800-63B) - consider it "restricted" due to security concerns
- Use SMS only as backup: Primary MFA should be TOTP app (Authy, Google Authenticator) or FIDO2 (YubiKey); SMS only for users who can't use apps
- Better alternatives: TOTP apps (phishing-prone but better than SMS), Push notification (user just taps "approve"), FIDO2/WebAuthn (phishing-resistant, strongest)
- Compliance note: For PSD2/SCA (EU banking), SMS may not qualify as "strong authentication" - use TOTP or FIDO2 for compliance
- Multiple MFA methods supported: LoginRadius supports TOTP (RFC 6238), SMS OTP, Email OTP, Security Questions, and FIDO2/WebAuthn (YubiKey, FaceID)
- Adaptive MFA policies: Configure risk-based rules - require MFA only for specific user groups, IP ranges, actions (password change, payment), or suspicious login patterns
- Step-up authentication: Users can browse with password only, but MFA is triggered for sensitive actions (checkout, profile changes, admin functions)
- User self-service: Users can enroll their own MFA devices (scan TOTP QR code, register FIDO2 key) through LoginRadius self-service portal
- Backup & recovery: Provide backup codes during MFA enrollment; support secondary email verification for account recovery when MFA device is lost