What MFA Factors Can Include: Something You Know, Something You Have, or Something You Are

Multi-factor authentication (MFA) factors can include something you know, something you have, or something you are, and each category proves identity through a different mechanism: memory, physical possession, or a body characteristic. MFA works because combining two or more categories defeats attacks that break just one. A stolen password fails without the registered phone, and a phishing page cannot copy a fingerprint.

The three authentication factor categories

Authentication factors split into three families based on what the verifier asks you to present. Knowledge factors test recall or recognition. A password, a PIN, a lock-screen pattern, and the answer to a security question all fall here. Your brain stores the secret, and the server compares a hash of what you typed against a stored hash.

Possession factors test control of a physical object. A smartphone running an authenticator app, a hardware security key, a smart card, and a one-time-code token all qualify. The device holds a secret, or a private key, that never travels to the server. A push notification is just a delivery channel; the phone itself is the factor.

Inherence factors test a biological or behavioral trait. Fingerprints, face geometry, iris patterns, and voiceprints are physical traits. Typing rhythm and gait are behavioral. Biometric data is probabilistic, matching within a threshold rather than verifying an exact string, which is why biometric sensors report confidence scores rather than yes-or-no answers.

Each category gets harder to attack in a different way. A password can be guessed from anywhere on Earth. A phone can be stolen, but only if the attacker is physically near you or has implanted malware. A fingerprint can be lifted from a glass, but turning it into a working spoof takes equipment and skill. MFA stacks categories because an attacker rarely beats two different mechanisms with one trick.

One detail separates modern MFA from older designs: the factor must be bound to the service. SMS codes and TOTP codes are valid for any prompt that requests them, which is why phishing kits relay them in real time. Passkeys and FIDO2 keys are cryptographically tied to the site's domain. The browser refuses to release the credential to a lookalike address. That binding, not the category, is what stops the most common modern attacks.

Why stacking categories beats strengthening one

Two weak factors from different categories usually beat one strong factor from a single category. Microsoft's 2019 analysis of over 1.2 billion accounts found that MFA blocked more than 99.9 percent of automated account compromise attacks. The number reflects passwords and codes defended against bulk credential-stuffing, not nation-state phishing. Microsoft's cloud logs also counted a yearly average of about 300 million fraudulent sign-in attempts, a volume no help desk can triage manually.

The arithmetic explains the gap. An attacker who guesses a password has already cleared the knowledge gate. They still need your physical device. If they steal the device, they still need your fingerprint or PIN. Each additional category multiplies the attacker's workload instead of adding to it.

The categories are not equally strong, and the difference is measurable. NIST Special Publication 800-63B ranks authenticators by assurance level, and single-factor options such as a memorized secret sit at the lowest tier. NIST advises against SMS for high-assurance use because the code can be intercepted or relayed. A FIDO2 hardware key resists phishing by design, because the key checks the origin before responding.

Volume metrics also mislead. An attack that bypasses MFA entirely, such as a real-time phishing proxy, does not appear as a failed sign-in. Counting blocked attempts flatters any MFA statistic. The question that matters is not how many attacks MFA stopped, but which attack classes it leaves open.

Push fatigue, SIM swaps, and other edge cases

Push fatigue attacks exploit the weakest link in approval-based MFA: human patience. The attacker already holds your password and fires repeated push prompts until you tap Approve out of irritation. Microsoft observed this pattern during the 2022 intrusion into its own corporate network, where the attacker bombarded an employee with prompts. Number matching, where the prompt displays a two-digit code you must type, defeats fatigue attacks because the attacker cannot see the number.

SIM swaps defeat SMS entirely at the carrier layer. An attacker persuades or bribes a carrier employee to port your number to a new SIM. Every future code goes to the attacker, so your possession factor is gone without touching your phone. Carriers now let customers set a port-out PIN, but that guard depends on the carrier's internal process. The fix is to treat SMS as a backup at best, never as the primary possession factor.

Real-time phishing proxies defeat SMS and TOTP together. A service such as Evilginx relays the login page, captures your password, forwards the code prompt, and replays the resulting session cookie to the real site. It does not break the cryptography. It breaks the assumption that only your server receives the code. Only origin-bound credentials, meaning passkeys and FIDO2 keys, systematically resist this class.

Lookalike domains and phone-support social engineering also bypass factors. In 2023, attackers used MGM Resorts' help desk to reset credentials, then used the legitimate reset flow to enroll their own authenticator device. The MFA was never broken; the enrollment process was. Security teams treat enrollment, recovery, and help-desk resets as part of the factor, not a side process.

A push prompt you did not initiate means your password is already compromised; report it instead of tapping Approve. A phone number that stops working, or a sudden carrier text about a port request, signals a SIM swap in progress. A code prompt arriving in a browser tab you did not open may be a phishing proxy. A help-desk call asking you to read a code or enroll a new device is a social-engineering attempt. Passkey or authenticator prompts appearing overnight suggest account takeover attempts via recovery paths.

The counterintuitive caveat here matters. Adding a second factor can make an account less secure during the enrollment window. An attacker who triggers a reset before your new device is bound can bind their own device first. Rollout plans should bind MFA during a controlled, verified session, not in response to a login prompt.

Factor types compared

The table shows a pattern. Phishing resistance tracks the binding between the credential and the site, not the sensory drama of the factor. A fingerprint that unlocks a passkey is strong because the passkey is bound. A fingerprint that unlocks a phone but authorizes any app is weaker than the table implies.

Misconceptions about what counts as a factor

The most common misconception treats two passwords as two factors. They are two instances of the same category, and compromising one usually compromises the other. Security questions are also knowledge factors. A childhood street name is often findable on social media, so relying on a security question is like using a password you published years ago.

Another misconception treats biometrics as unfalsifiable identity. Fingerprints can be lifted and cast into spoofs, and face unlock has been fooled by high-resolution photos and masks. Liveness detection, which checks for depth, motion, or infrared cues, closes some of the gap. Even so, biometrics identify traits, not people, and traits can be copied.

Multi-factor does not mean two-step. Entering a password and then answering a call-center identity quiz is two steps, both knowledge-based. Two prompts from the same authenticator app are also one category. Real MFA crosses categories and binds each credential to the service.

Finally, attackers reuse identity data across services. A breach at one provider can leak a phone number, a birth date, and a password. When a second service asks the same questions, the attacker relogs with the same answers. Each additional knowledge factor adds convenience, not security. The defensive move is to reduce questions, not to add them.

There is one more professional caveat. An authenticator app on a phone that receives push prompts can be the possession factor, but only if the phone itself is secured. Malware that reads notifications, or a cloud backup that clones the app with its secrets, converts possession into something an attacker can copy. Hardware-bound keys have no backup path, so they resist cloning, which is exactly why losing one matters.

Rolling it out in practice

Start by inventorying every account where a successful login harms you or others. Email, banking, payroll, cloud administration, and health records top that list. Prioritize those accounts before social media.

Classify each account's current MFA as a category, not as enabled or disabled. Write down whether the second step is something you know, something you have, or something you are. If both steps land in the same category, the account has redundant single-factor protection.

For high-value accounts, enroll a phishing-resistant credentials. Set up at least two FIDO2 keys, one carried and one stored offline, so a lost key does not lock you out. If hardware keys are impractical, prefer passkeys synced to a platform account, and treat the platform account itself as a critical asset.

Register every recovery path. Check the phone number, backup email, and recovery codes on each account and confirm they are current. Recovery is the weakest link in most MFA deployments, and attackers know it.

For organizations, institute number matching or phishing-resistant MFA for all administrators first. Require hardware keys for privileged cloud roles. Set a threshold: any account that can change billing, deploy code, or reset other users' MFA should carry a phishing-resistant factor.

Set concrete review cadences. Review registered authenticators quarterly, and reach for recovery codes once to confirm they decrypt. A lost YubiKey costs about USD 50 to replace, which is a trivial cost against a compromised administrator session.

Limitations are real. Passkeys and FIDO2 support is not universal, and some legacy systems still rely on SMS. Not every consumer service accepts hardware keys, and platform lock-in lets one login provider guard several accounts at once. Biometric accuracy varies across populations, and false rejection rates can frustrate users into weaker fallbacks.

Most important, MFA protects authentication, not authorization. An attacker who logs in as you inherits whatever your account can do. Maintain least privilege and legitimate session monitoring alongside any MFA program.

This article is general educational information about authentication concepts, not a security audit, legal opinion, or insurance recommendation. It cannot account for your specific systems, threats, or regulatory obligations. Consult a qualified security professional before changing controls on sensitive accounts.