Defence

MFA

Multi-factor authentication

Requiring a second proof besides a password, such as an app prompt, a code or a security key.

MFA stops most password-only attacks. Not all MFA is equal: codes and push prompts can be phished or fatigued, while passkeys and hardware security keys are bound to the real site and resist phishing.