Multi-Factor Authentication (MFA)
Term 24 of 68 in the ERPStack technical glossary
What is Multi-Factor Authentication (MFA)?
Multi-Factor Authentication (MFA) is a security authentication process that requires a user to provide two or more verification factors to gain access to a resource, minimizing credential theft risk.
Multi-Factor Authentication (MFA) at a glance
- Factor types
- 3 categories: something you know, something you have, something you are
- Strongest common form
- Phishing-resistant hardware or platform authenticators bound to 1 origin
- Weakest common form
- SMS codes — interceptable, and vulnerable to SIM reassignment
- Coverage gap
- Account recovery and 1 unprotected legacy login path defeat 100% of the control
- Built with
- MFA enforced at the identity provider in front of Next.js 16 applications on Vercel or AWS, sessions recorded in PostgreSQL 18, operator access through a Bastion Host, failures surfaced in Sentry
- Numbers that matter
- 3 factor categories, 2 required; 1 unprotected recovery path defeats 100% of the control; 0 knowledge-only pairs count as multi-factor
- Compare with
- Password-only sign-in, SSO without a second factor, or an OAuth flow with 0 phishing resistance in front of a Next.js 16 application
- Commonly paired with
- SSO at the identity provider, OAuth flows, JWT sessions, RBAC above them, a Bastion Host for operators, Next.js 16 middleware checks, and SOC 2, ISO 27001 or FedRAMP Security Controls evidence
- Coverage audit
- 4 paths to check — interactive login, API keys, help-desk reset, and legacy endpoints; 1 gap defeats 100% of the control
- Enforcement points
- SSO at the identity provider, JWT session claims, RBAC in Next.js 16 server actions, a Bastion Host for operator access and PostgreSQL 18 policies underneath — 5 places the second factor still has to hold.
- Where it is sampled
- healthcare, finance, government and retail estates working to SOC 2, ISO 27001, HIPAA or PCI DSS: 4 sectors, 4 frameworks, and 1 recovery path capable of undoing all of them.
How Multi-Factor Authentication (MFA) works in production
The ERPStack approach to Multi-Factor Authentication (MFA)
We integrate custom-grade MFA and biometric passkeys into our custom applications, protecting admin consoles and customer directories from account takeovers.
Frequently asked questions about Multi-Factor Authentication (MFA)
What makes authentication genuinely Multi-Factor?
Factors from different categories. Multi-Factor Authentication requires 2 of the 3 recognised kinds — knowledge, possession and inherence — so a password plus a security question is not multi-factor at all, since both are things you know. The point is that compromising 1 category should not compromise the other, which is why a hardware key and a password are a meaningfully stronger pair.
Why are SMS codes considered weak?
Because the possession factor is not really bound to the device. Multi-Factor Authentication over SMS can be defeated by SIM reassignment, by interception, and most commonly by a phishing page that relays the code in real time. It is still far better than a password alone, so it belongs in a migration plan rather than being removed abruptly — but it should not be the target state.
What is phishing-resistant MFA?
Authentication cryptographically bound to the site requesting it. A hardware or platform authenticator signs a challenge tied to the origin, so a credential presented to a lookalike domain simply does not verify. That closes the gap that one-time codes leave open, because Multi-Factor Authentication using a code the user can read aloud can always be relayed by an attacker who asks for it convincingly.
Where do MFA rollouts usually fail?
At the edges, not the main login. Multi-Factor Authentication is only as strong as the weakest path to the account, so an unprotected legacy endpoint, an API key that bypasses interactive login, or a help-desk reset that accepts a phone call all defeat it. Enrolment and recovery deserve the same design attention as the sign-in screen, because attackers reliably target the cheapest route.