What Is Multifactor Authentication (MFA)?

<!DOCTYPE html> <html lang="en-us" dir="ltr" prefix="content: http://purl.org/rss/1.0/modules/content/ dc: http://purl.org/dc/terms/ foaf: http://xmlns.com/foaf/0.1/ og: http://ogp.me/ns# rdfs: http://www.w3.org/2000/01/rdf-schema# schema: http://schema.org/ sioc: http://rdfs.org/sioc/ns# sioct: http://rdfs.org/sioc/types# skos: http://www.w3.org/2004/02/skos/core# xsd: http://www.w3.org/2001/XMLSchema# " class="page-en"> <head> <script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-MGR7P8X');</script> <script async src="https://www.googletagmanager.com/gtag/js?id=G-B1V8SZE3GL"></script> <script>window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-B1V8SZE3GL');</script> <script>(function(){var a=window.mutiny=window.mutiny||{};if(!window.mutiny.client){a.client={_queue:{}};var b=["identify","trackConversion"];var c=[].concat(b,["defaultOptOut","optOut","optIn"]);var d=function factory(c){return function(){for(var d=arguments.length,e=new Array(d),f=0;f<d;f++){e[f]=arguments[f]}a.client._queue[c]=a.client._queue[c]||[];if(b.includes(c)){return new Promise(function(b,d){a.client._queue[c].push({args:e,resolve:b,reject:d})})}else{a.client._queue[c].push({args:e})}}};c.forEach(function(b){a.client[b]=d(b)})}})();</script> <script data-cfasync="false" src="https://client-registry.mutinycdn.com/personalize/client/d454424c4514a20a.js"></script> <meta charset="utf-8" /> <meta name="description" content="Multifactor authentication (MFA) adds protection from hackers, preventing account access without secondary authentication. Learn what MFA is and how it protects you." /> <link rel="shortlink" href="https://www.proofpoint.com/us/threat-reference/multifactor-authentication" /> <link rel="canonical" href="https://www.proofpoint.com/us/threat-reference/multifactor-authentication" /> <link rel="icon" href="/themes/custom/proofpoint/apps/drupal/favicon.ico" /> <link rel="mask-icon" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon.svg" /> <link rel="icon" sizes="16x16" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-16x16.png" /> <link rel="icon" sizes="32x32" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-32x32.png" /> <link rel="icon" sizes="96x96" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-96x96.png" /> <link rel="icon" sizes="192x192" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-192x192.png" /> <link rel="apple-touch-icon" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-60x60.png" /> <link rel="apple-touch-icon" sizes="72x72" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-72x72.png" /> <link rel="apple-touch-icon" sizes="76x76" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-76x76.png" /> <link rel="apple-touch-icon" sizes="114x114" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-114x114.png" /> <link rel="apple-touch-icon" sizes="120x120" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-120x120.png" /> <link rel="apple-touch-icon" sizes="144x144" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-144x144.png" /> <link rel="apple-touch-icon" sizes="152x152" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-152x152.png" /> <link rel="apple-touch-icon" sizes="180x180" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-180x180.png" /> <link rel="apple-touch-icon-precomposed" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-57x57.png" /> <link rel="apple-touch-icon-precomposed" sizes="72x72" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-72x72.png" /> <link rel="apple-touch-icon-precomposed" sizes="76x76" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-76x76.png" /> <link rel="apple-touch-icon-precomposed" sizes="114x114" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-114x114.png" /> <link rel="apple-touch-icon-precomposed" sizes="120x120" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-120x120.png" /> <link rel="apple-touch-icon-precomposed" sizes="144x144" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-144x144.png" /> <link rel="apple-touch-icon-precomposed" sizes="152x152" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-152x152.png" /> <link rel="apple-touch-icon-precomposed" sizes="180x180" href="/themes/custom/proofpoint/apps/drupal/images/favicons/favicon-180x180.png" /> <meta property="og:site_name" content="Proofpoint" /> <meta property="og:type" content="website" /> <meta property="og:url" content="https://www.proofpoint.com/us/threat-reference/multifactor-authentication" /> <meta property="og:title" content="What Is Multifactor Authentication (MFA)? | Proofpoint US" /> <meta property="og:description" content="Multifactor authentication (MFA) adds protection from hackers, preventing account access without secondary authentication. Learn what MFA is and how it protects you." /> <meta property="og:image" content="" /> <meta property="og:image:url" content="" /> <meta property="og:image:secure_url" content="" /> <meta property="article:published_time" content="2021-06-30T09:59:51-07:00" /> <meta property="article:modified_time" content="2023-11-02T13:54:27-07:00" /> <meta name="twitter:card" content="summary_large_image" /> <meta name="twitter:description" content="Multifactor authentication (MFA) adds protection from hackers, preventing account access without secondary authentication. Learn what MFA is and how it protects you." /> <meta name="twitter:title" content="What Is Multifactor Authentication (MFA)? | Proofpoint US" /> <meta name="twitter:site" content="@proofpoint" /> <meta name="twitter:url" content="https://www.proofpoint.com/us/threat-reference/multifactor-authentication" /> <meta name="twitter:image" content="" /> <script data-cfasync="false" type="text/javascript" id="vwoCode">window._vwo_code=window._vwo_code || (function() { var account_id=767242, version=1.3, settings_tolerance=2000, library_tolerance=2500,z use_existing_jquery=false, is_spa=1, hide_element='body', /* DO NOT EDIT BELOW THIS LINE */ f=false,d=document,code={use_existing_jquery:function(){return use_existing_jquery},library_tolerance:function(){return library_tolerance},finish:function(){if(!f){f=true;var e=d.getElementById('_vis_opt_path_hides');if(e)e.parentNode.removeChild(e)}},finished:function(){return f},load:function(e){var t=d.createElement('script');t.fetchPriority='high';t.src=e;t.type='text/javascript';t.innerText;t.onerror=function(){_vwo_code.finish()};d.getElementsByTagName('head')[0].appendChild(t)},init:function(){window.settings_timer=setTimeout(function(){_vwo_code.finish()},settings_tolerance);var e=d.createElement('style'),t=hide_element?hide_element+'{opacity:0 !important;filter:alpha(opacity=0) !important;background:none !important;}':'',i=d.getElementsByTagName('head')[0];e.setAttribute('id','_vis_opt_path_hides');e.setAttribute('nonce',document.querySelector('#vwoCode').nonce);e.setAttribute('type','text/css');if(e.styleSheet)e.styleSheet.cssText=t;else e.appendChild(d.createTextNode(t));i.appendChild(e);this.load('https://dev.visualwebsiteoptimizer.com/j.php?a='+account_id+'&u='+encodeURIComponent(d.URL)+'&f='+ +is_spa+'&vn='+version);return settings_timer}};window._vwo_settings_timer = code.init();return code;}());</script> <meta name="facebook-domain-verification" content="l349mr2tyecyl7w3a1146378lqxru1" /> <meta name="MobileOptimized" content="width" /> <meta name="HandheldFriendly" content="true" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <link rel="preload" href="/themes/custom/proofpoint/dist/app-drupal/assets/fonts/proofpoint.woff2" as="font" crossorigin="anonymous" /> <link rel="preload" href="/themes/custom/proofpoint/dist/app-drupal/assets/fonts/RobotoCondensed-Regular-webfont.woff" as="font" crossorigin="anonymous" /> <link rel="preload" href="/themes/custom/proofpoint/dist/app-drupal/assets/fonts/fjalla-one-v7-latin-regular.woff" as="font" crossorigin="anonymous" /> <link rel="preload" href="/themes/custom/proofpoint/dist/app-drupal/assets/fonts/fjalla-one-v7-latin-regular.woff2" as="font" crossorigin="anonymous" /> <link rel="preload" href="/themes/custom/proofpoint/dist/app-drupal/assets/fonts/RobotoCondensed-Bold-webfont.woff" as="font" crossorigin="anonymous" /> <link rel="alternate" hreflang="en-us" href="https://www.proofpoint.com/us/threat-reference/multifactor-authentication" /> <link rel="alternate" hreflang="en-gb" href="https://www.proofpoint.com/uk/threat-reference/multifactor-authentication" /> <link rel="alternate" hreflang="fr" href="https://www.proofpoint.com/fr/threat-reference/multifactor-authentication" /> <link rel="alternate" hreflang="de" href="https://www.proofpoint.com/de/threat-reference/multifactor-authentication" /> <link rel="alternate" hreflang="es" href="https://www.proofpoint.com/es/threat-reference/multifactor-authentication" /> <link rel="alternate" hreflang="ja" href="https://www.proofpoint.com/jp/threat-reference/multifactor-authentication" /> <link rel="alternate" hreflang="en-au" href="https://www.proofpoint.com/au/threat-reference/multifactor-authentication" /> <link rel="alternate" hreflang="it" href="https://www.proofpoint.com/it/threat-reference/multifactor-authentication" /> <title>What Is Multifactor Authentication (MFA)? | Proofpoint US</title> <link rel="stylesheet" media="all" href="/sites/default/files/css/css_5x1zduTS4IFCCOssa4IT2g5zuOu1aGbQfcPEEW3PgCM.css?delta=0&language=en&theme=particle&include=eJxdkFFuAzEIRC8Ux6r609tE2Eu8VliwAEfN7euNqq63nzxGzDCt3erHF0cCLh0KhgUds4teWrttoA90iVvnvD4q78wQNK-xeyXbZ19xw-gilEAv9jLHLSYwvDRQr5kwZlGcpJAYUqpcDkURKYThLux20LuIo4bn5yQkMQN9BZbl5MCO7KGND_TAK8Jy8kk6SNa-pbcNFIW2Wly0N6DrQa6dW09UbcVlcnEICZhnixEoAQWk8dopvDXIU8JEUoL1ZFlrmvgfCkORH8dC0aRrRvu_2C8dk-O3hyzUN56bU8TgWkeyBow0V6Ly-8Sp2L2qgRiePyzZzBQ" /> <link rel="stylesheet" media="all" href="/sites/default/files/css/css_RSigviShmk-Sa9dAyUxmSMTb_CBGFwqFflqZx2eu1ls.css?delta=1&language=en&theme=particle&include=eJxdkFFuAzEIRC8Ux6r609tE2Eu8VliwAEfN7euNqq63nzxGzDCt3erHF0cCLh0KhgUds4teWrttoA90iVvnvD4q78wQNK-xeyXbZ19xw-gilEAv9jLHLSYwvDRQr5kwZlGcpJAYUqpcDkURKYThLux20LuIo4bn5yQkMQN9BZbl5MCO7KGND_TAK8Jy8kk6SNa-pbcNFIW2Wly0N6DrQa6dW09UbcVlcnEICZhnixEoAQWk8dopvDXIU8JEUoL1ZFlrmvgfCkORH8dC0aRrRvu_2C8dk-O3hyzUN56bU8TgWkeyBow0V6Ly-8Sp2L2qgRiePyzZzBQ" /> <script src="/sites/default/files/js/js_Wi8RdyzDF-uwGcwq9eMv1Giiu7RfMo7nYneG5kg6rd4.js?scope=header&delta=0&language=en&theme=particle&include=eJxdkFFuAzEIRC8Ux6r609tE2Eu8VliwAEfN7euNqq63nzxGzDCt3erHF0cCLh0KhgUds4teWrttoA90iVvnvD4q78wQNK-xeyXbZ19xw-gilEAv9jLHLSYwvDRQr5kwZlGcpJAYUqpcDkURKYThLux20LuIo4bn5yQkMQN9BZbl5MCO7KGND_TAK8Jy8kk6SNa-pbcNFIW2Wly0N6DrQa6dW09UbcVlcnEICZhnixEoAQWk8dopvDXIU8JEUoL1ZFlrmvgfCkORH8dC0aRrRvu_2C8dk-O3hyzUN56bU8TgWkeyBow0V6Ly-8Sp2L2qgRiePyzZzBQ"></script> </head> <body class="path-node"> <a href="#main-content" class="visually-hidden focusable"> Skip to main content </a> <div class="limit-width-wrapper"> <div class="dialog-off-canvas-main-canvas" data-off-canvas-main-canvas> <div class="header-nav__spacer"></div> <div class="header-nav js-is-top"> <div class="header-nav__extra"> <div class="header-nav__extra-wrap"> <div class="header-nav__top-language" data-open="content:x_lng"> <span>English (Americas)</span> </div> <div class="header-nav__actions"> <div class="header-nav__top-search" data-open="content:x_sch"> <span>Search</span> </div> <div class="header-nav__top-login" data-open="content:x_lgn"> <span>Login</span> </div> </div> </div> </div> <div class="header-nav__main"> <div class="header-nav__main-wrap"> <div class="header-nav__expand" data-open="home"></div> <ul class="header-nav__top-links"> <li class="header-nav__top-link"> <div data-open="content:platform_panel" class="header-nav__top-link-text"> Platform </div> </li> <li class="header-nav__top-link"> <div data-open="content:products_panel" class="header-nav__top-link-text"> Products </div> </li> <li class="header-nav__top-link"> <div data-open="content:solutions_panel" class="header-nav__top-link-text"> Solutions </div> </li> </ul> <a href="/us" class="header-nav__logo">Proofpoint</a> <div class="header-nav__buttons"> <a href=/us/contact class="global-elements__cta-button--outline header-nav__button" > <span>Contact</span> <div class="global-elements__cta-button--arrow-wrapper"></div> </a> </div> <div class="header-nav__mobile-actions"> <div class="header-nav__mobile-search" data-open="content:x_sch">Search</div> <div class="header-nav__mobile-menu" data-open="home"></div> </div> </div> </div> </div> <div class="header-nav__menu"> <div class="header-nav__menu-wrapper"> <div class="header-nav__menu-close"></div> <div class="header-nav__menu-pane" data-home={true}> <ul class="header-nav__home-links"> <li class="header-nav__home-link" data-open="content:platform_panel" ><span>Platform</span></li> <li class="header-nav__home-link" data-open="content:products_panel" ><span>Products</span></li> <li class="header-nav__home-link" data-open="content:solutions_panel" ><span>Solutions</span></li> <li class="header-nav__home-link" data-open="content:partners_panel" ><span>Partners</span></li> <li class="header-nav__home-link" data-open="content:resources_panel" ><span>Resources</span></li> <li class="header-nav__home-link" data-open="content:company_panel" ><span>Company</span></li> </ul> <div class="header-nav__menu-extras"> <div class="header-nav__menu-search" data-open="content:x_sch">Search</div> <div class="header-nav__menu-login" data-open="content:x_lgn">Login</div> <div class="header-nav__menu-language" data-open="content:x_lng">English (Americas)</div> </div> </div> <div class="header-nav__menu-pane" data-sublinks="Platform"> <div class="header-nav__sublinks"> <div class="header-nav__expand-title">Platform</div> <ul class="header-nav__expand-links"> </ul> </div> </div> <div class="header-nav__menu-pane" data-sublinks="Products"> <div class="header-nav__sublinks"> <div class="header-nav__expand-title">Products</div> <ul class="header-nav__expand-links"> </ul> </div> </div> <div class="header-nav__menu-pane" data-sublinks="Solutions"> <div class="header-nav__sublinks"> <div class="header-nav__expand-title">Solutions</div> <ul class="header-nav__expand-links"> </ul> </div> </div> <div class="header-nav__menu-pane" data-sublinks="Partners"> <div class="header-nav__sublinks"> <div class="header-nav__expand-title">Partners</div> <ul class="header-nav__expand-links"> </ul> </div> </div> <div class="header-nav__menu-pane" data-sublinks="Resources"> <div class="header-nav__sublinks"> <div class="header-nav__expand-title">Resources</div> <ul class="header-nav__expand-links"> </ul> </div> </div> <div class="header-nav__menu-pane" data-sublinks="Company"> <div class="header-nav__sublinks"> <div class="header-nav__expand-title">Company</div> <ul class="header-nav__expand-links"> </ul> </div> </div> <div class="header-nav__menu-pane" data-content="products_panel"> <div class="header-nav__content"> <a href="/us/products/protect-people" class="header-nav__content-link-group-anchor"> <div class="header-nav__content-link-group"> <div class="header-nav__content-group-title">Protect People</div> <div class="header-nav__content-group-desc">Multi-layered, adaptive defenses for threat detection, impersonation, and supplier risk.</div> </div> </a> <div class="header-nav__content-link"> <a href="/us/products/threat-defense" class="header-nav__content-link-text">Email Security</a> </div> <div class="header-nav__content-link"> <a href="/us/products/impersonation-protection" class="header-nav__content-link-text">Impersonation Protection</a> </div> <div class="header-nav__content-link"> <a href="#" class="header-nav__content-link-text" data-open="content:products_more_tp_products_panel">More products</a> </div> <a href="/us/products/defend-data" class="header-nav__content-link-group-anchor"> <div class="header-nav__content-link-group"> <div class="header-nav__content-group-title">Defend Data</div> <div class="header-nav__content-group-desc">Transform your information protection with a human-centric, omni-channel approach.</div> </div> </a> <div class="header-nav__content-link"> <a href="/us/products/data-loss-prevention" class="header-nav__content-link-text">Enterprise DLP</a> </div> <div class="header-nav__content-link"> <a href="/us/products/adaptive-email-dlp" class="header-nav__content-link-text">Adaptive Email DLP</a> </div> <div class="header-nav__content-link"> <a href="/us/products/insider-threat-management" class="header-nav__content-link-text">Insider Threat Management</a> </div> <div class="header-nav__content-link"> <a href="/us/products/compliance-and-archiving" class="header-nav__content-link-text">Intelligent Compliance</a> </div> <div class="header-nav__content-link-group"> <div class="header-nav__content-group-title">Mitigate Human Risk</div> <div class="header-nav__content-group-desc">Unlock full user risk visibility and drive behavior change.</div> </div> <div class="header-nav__content-link"> <a href="/us/products/mitigate-human-risk" class="header-nav__content-link-text">Security Awareness</a> </div> <div class="header-nav__content-link-group"> <div class="header-nav__content-group-title">Augment Your Capabilities</div> </div> <div class="header-nav__content-link"> <a href="/us/products/premium-services" class="header-nav__content-link-text">Managed Services</a> </div> <div class="header-nav__content-link"> <a href="/us/products/packages" class="header-nav__content-link-text">Product Packages</a> </div> <div class="header-nav__content-link-spacer"></div> </div> </div> <div class="header-nav__menu-pane" data-content="products_more_tp_products_panel"> <div class="header-nav__content"> <div class="header-nav__content-heading">More Protect People Products</div> <div class="header-nav__content-link"> <a href="/us/products/identity-protection" class="header-nav__content-link-text">Account Take-Over and Identity Protection</a> <div class="header-nav__content-link-desc">Secure vulnerable identities, stop lateral movement and privilege escalation.</div> </div> <div class="header-nav__content-link"> <a href="/us/products/adaptive-email-security" class="header-nav__content-link-text">Adaptive Email Security</a> <div class="header-nav__content-link-desc">Stop more threats with a fully integrated layer of behavioral AI.</div> </div> <div class="header-nav__content-link"> <a href="/us/products/email-security-and-protection/secure-email-relay" class="header-nav__content-link-text">Secure Email Relay</a> <div class="header-nav__content-link-desc">Secure your application email and accelerate DMARC implementation</div> </div> </div> </div> <div class="header-nav__menu-pane" data-content="solutions_panel"> <div class="header-nav__content"> <div class="header-nav__content-link-group"> <div class="header-nav__content-group-title">Solutions by Use Case</div> <div class="header-nav__content-group-desc">How Proofpoint protects your people and data.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/email-authentication-with-dmarc" class="header-nav__content-link-text">Authenticate Your Email</a> <div class="header-nav__content-link-desc">Protect your email deliverability with DMARC.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/combat-email-and-cloud-threats" class="header-nav__content-link-text">Combat Email and Cloud Threats</a> <div class="header-nav__content-link-desc">Protect your people from email and cloud threats with an intelligent and holistic approach.</div> </div> <div class="header-nav__content-link"> <a href="#" class="header-nav__content-link-text" data-open="content:solutions_by_use_case_panel">More use cases</a> </div> <div class="header-nav__content-link-group"> <div class="header-nav__content-group-title">Solutions by Industry</div> <div class="header-nav__content-group-desc">People-centric solutions for your organization.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/federal" class="header-nav__content-link-text">Federal Government</a> <div class="header-nav__content-link-desc">Cybersecurity for federal government agencies.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/state-and-local-government" class="header-nav__content-link-text">State and Local Government</a> <div class="header-nav__content-link-desc">Protecting the public sector, and the public from cyber threats.</div> </div> <div class="header-nav__content-link"> <a href="#" class="header-nav__content-link-text" data-open="content:solutions_by_industry_panel">More industries</a> </div> <a href="/us/compare" class="header-nav__content-link-group-anchor"> <div class="header-nav__content-link-group"> <div class="header-nav__content-group-title">Comparing Proofpoint</div> <div class="header-nav__content-group-desc">Evaluating cybersecurity vendors? Check out our side-by-side comparisons.</div> </div> </a> <div class="header-nav__content-link"> <a href="#" class="header-nav__content-link-text" data-open="content:compare_proofpoint_panel">View comparisons</a> </div> </div> </div> <div class="header-nav__menu-pane" data-content="solutions_by_use_case_panel"> <div class="header-nav__content"> <h3 class="header-nav__content-title">Solutions By Use Case</h3> <div class="header-nav__content-heading">How Proofpoint protects your people and data.</div> <div class="header-nav__content-link"> <a href="/us/solutions/change-user-behavior" class="header-nav__content-link-text">Change User Behavior</a> <div class="header-nav__content-link-desc">Help your employees identify, resist and report attacks before the damage is done.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/combat-data-loss-and-insider-risk" class="header-nav__content-link-text">Combat Data Loss and Insider Risk</a> <div class="header-nav__content-link-desc">Prevent data loss via negligent, compromised and malicious insiders.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/enable-intelligent-compliance" class="header-nav__content-link-text">Modernize Compliance and Archiving</a> <div class="header-nav__content-link-desc">Manage risk and data retention needs with a modern compliance and archiving solution.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/protect-cloud-apps" class="header-nav__content-link-text">Protect Cloud Apps</a> <div class="header-nav__content-link-desc">Keep your people and their cloud apps secure by eliminating threats and data loss.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/prevent-loss-from-ransomware" class="header-nav__content-link-text">Prevent Loss from Ransomware</a> <div class="header-nav__content-link-desc">Learn about this growing threat and stop attacks by securing ransomware's top vector: email.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/secure-microsoft-365" class="header-nav__content-link-text">Secure Microsoft 365</a> <div class="header-nav__content-link-desc">Implement the best security and compliance solution for Microsoft 365.</div> </div> </div> </div> <div class="header-nav__menu-pane" data-content="solutions_by_industry_panel"> <div class="header-nav__content"> <h3 class="header-nav__content-title">Solutions By Industry</h3> <div class="header-nav__content-heading">People-centric solutions for your organization.</div> <div class="header-nav__content-link"> <a href="/us/solutions/higher-education-security" class="header-nav__content-link-text">Higher Education</a> <div class="header-nav__content-link-desc">A higher level of security for higher education.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/financial-services-and-insurance" class="header-nav__content-link-text">Financial Services</a> <div class="header-nav__content-link-desc">Eliminate threats, build trust and foster growth for your organization.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/healthcare-information-security" class="header-nav__content-link-text">Healthcare</a> <div class="header-nav__content-link-desc">Protect clinicians, patient data, and your intellectual property against advanced threats.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/mobile-message-security-solutions-for-service-providers" class="header-nav__content-link-text">Mobile Operators</a> <div class="header-nav__content-link-desc">Make your messaging environment a secure environment.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/email-security-solutions-for-service-providers" class="header-nav__content-link-text">Internet Service Providers</a> <div class="header-nav__content-link-desc">Cloudmark email protection.</div> </div> <div class="header-nav__content-link"> <a href="/us/solutions/protection-compliance-small-business" class="header-nav__content-link-text">Small and Medium Businesses</a> <div class="header-nav__content-link-desc">Big-time security for small business.</div> </div> </div> </div> <div class="header-nav__menu-pane" data-content="compare_proofpoint_panel"> <div class="header-nav__content"> <h3 class="header-nav__content-title">Proofpoint vs. the competition</h3> <div class="header-nav__content-heading">Side-by-side comparisons.</div> <div class="header-nav__content-link"> <a href="/us/compare/proofpoint-vs-abnormal-security" class="header-nav__content-link-text">Proofpoint vs. Abnormal Security</a> </div> <div class="header-nav__content-link"> <a href="/us/compare/proofpoint-vs-mimecast" class="header-nav__content-link-text">Proofpoint vs. Mimecast</a> </div> <div class="header-nav__content-link"> <a href="/us/compare/proofpoint-vs-cisco" class="header-nav__content-link-text">Proofpoint vs. Cisco</a> </div> <div class="header-nav__content-link"> <a href="/us/compare/proofpoint-vs-microsoft" class="header-nav__content-link-text">Proofpoint vs Microsoft</a> </div> <div class="header-nav__content-link"> <a href="/us/compare/proofpoint-vs-microsoft-purview" class="header-nav__content-link-text">Proofpoint vs. Microsoft Purview</a> </div> <div class="header-nav__content-link"> <a href="/us/compare/proofpoint-vs-legacy-dlp" class="header-nav__content-link-text">Proofpoint vs. Legacy DLP</a> </div> </div> </div> <div class="header-nav__menu-pane" data-content="partners_panel"> <div class="header-nav__content"> <h3 class="header-nav__content-title">Partners</h3> <div class="header-nav__content-heading">Deliver Proofpoint solutions to your customers.</div> <a href=https://partners.proofpoint.com class="global-elements__cta-button header-nav__content-button" > <span>Channel Partners</span> <div class="global-elements__cta-button--arrow-wrapper"></div> </a> <div class="header-nav__content-link"> <a href="/us/partners/trusted-data-solutions-partnership" class="header-nav__content-link-text">Archive Extraction Partners</a> <div class="header-nav__content-link-desc">Learn about Extraction Partners.</div> </div> <div class="header-nav__content-link"> <a href="/us/global-system-integrator-gsi-and-global-managed-service-provider-msp-partners" class="header-nav__content-link-text">GSI and MSP Partners</a> <div class="header-nav__content-link-desc">Learn about our global consulting.</div> </div> <div class="header-nav__content-link"> <a href="/us/partners/technology-alliance-partners" class="header-nav__content-link-text">Technology and Alliance Partners</a> <div class="header-nav__content-link-desc">Learn about our relationships.</div> </div> <div class="header-nav__content-link"> <a href="/us/partners/digital-risk-and-compliance-partners" class="header-nav__content-link-text">Social Media Protection Partners</a> <div class="header-nav__content-link-desc">Learn about the technology and....</div> </div> <div class="header-nav__content-link"> <a href="/us/channel-partners-small-and-medium-business" class="header-nav__content-link-text">Proofpoint Essentials Partner Programs</a> <div class="header-nav__content-link-desc">Small Business Solutions .</div> </div> <div class="header-nav__content-link"> <a href="https://partners.proofpoint.com/prm/English/s/applicant" class="header-nav__content-link-text">Become a Channel Partner</a> </div> </div> </div> <div class="header-nav__menu-pane" data-content="resources_panel"> <div class="header-nav__content"> <h3 class="header-nav__content-title">Resources</h3> <div class="header-nav__content-heading">Find reports, webinars, blogs, events, podcasts and more.</div> <a href=/us/resources class="global-elements__cta-button header-nav__content-button" > <span>Resource Library</span> <div class="global-elements__cta-button--arrow-wrapper"></div> </a> <div class="header-nav__content-link"> <a href="/us/blog" class="header-nav__content-link-text">Blog</a> <div class="header-nav__content-link-desc">Keep up with the latest news and happenings.</div> </div> <div class="header-nav__content-link"> <a href="/us/webinars" class="header-nav__content-link-text">Webinars</a> <div class="header-nav__content-link-desc">Browse our webinar library to learn about the latest threats, trends and issues in cybersecurity.</div> </div> <div class="header-nav__content-link"> <a href="/us/cybersecurity-academy" class="header-nav__content-link-text">Cybersecurity Academy</a> <div class="header-nav__content-link-desc">Earn your certification to become a Proofpoint Certified Guardian.</div> </div> <div class="header-nav__content-link"> <a href="/us/podcasts" class="header-nav__content-link-text">Podcasts</a> <div class="header-nav__content-link-desc">Learn about the human side of cybersecurity.</div> </div> <div class="header-nav__content-link"> <a href="/us/new-perimeters" class="header-nav__content-link-text">New Perimeters Magazine</a> <div class="header-nav__content-link-desc">Get the latest cybersecurity insights in your hands.</div> </div> <div class="header-nav__content-link"> <a href="/us/threat-reference" class="header-nav__content-link-text">Threat Glossary</a> <div class="header-nav__content-link-desc">Learn about the latest security threats.</div> </div> <div class="header-nav__content-link"> <a href="/us/events" class="header-nav__content-link-text">Events</a> <div class="header-nav__content-link-desc">Connect with us at events to learn how to protect your people and data from ever-evolving threats.</div> </div> <div class="header-nav__content-link"> <a href="/us/customer-stories" class="header-nav__content-link-text">Customer Stories</a> <div class="header-nav__content-link-desc">Read how our customers solve their most pressing cybersecurity challenges.</div> </div> </div> </div> <div class="header-nav__menu-pane" data-content="company_panel"> <div class="header-nav__content"> <h3 class="header-nav__content-title">Company</h3> <div class="header-nav__content-heading">Proofpoint protects organizations' greatest assets and biggest risks: their people.</div> <a href=/us/company/about class="global-elements__cta-button header-nav__content-button" > <span>About Proofpoint</span> <div class="global-elements__cta-button--arrow-wrapper"></div> </a> <div class="header-nav__content-link"> <a href="/us/why-proofpoint" class="header-nav__content-link-text">Why Proofpoint</a> <div class="header-nav__content-link-desc">Learn about our unique people-centric approach to protection.</div> </div> <div class="header-nav__content-link"> <a href="/us/company/careers" class="header-nav__content-link-text">Careers</a> <div class="header-nav__content-link-desc">Stand out and make a difference at one of the world's leading cybersecurity companies.</div> </div> <div class="header-nav__content-link"> <a href="/us/newsroom" class="header-nav__content-link-text">News Center</a> <div class="header-nav__content-link-desc">Read the latest press releases, news stories and media highlights about Proofpoint.</div> </div> <div class="header-nav__content-link"> <a href="/us/legal/trust" class="header-nav__content-link-text">Privacy and Trust</a> <div class="header-nav__content-link-desc">Learn about how we handle data and make commitments to privacy and other regulations.</div> </div> <div class="header-nav__content-link"> <a href="/us/legal/esg" class="header-nav__content-link-text">Environmental, Social, and Governance</a> <div class="header-nav__content-link-desc">Learn how we apply our principles to positively impact our community.</div> </div> <div class="header-nav__content-link"> <a href="/us/support-services" class="header-nav__content-link-text">Support</a> <div class="header-nav__content-link-desc">Access the full range of Proofpoint support services.</div> </div> </div> </div> <div class="header-nav__menu-pane" data-content="platform_panel"> <div class="header-nav__content"> <h3 class="header-nav__content-title">Platform</h3> <div class="header-nav__content-heading">Discover the Proofpoint human-centric platform.</div> <a href=/us/platform class="global-elements__cta-button header-nav__content-button" > <span>Learn More</span> <div class="global-elements__cta-button--arrow-wrapper"></div> </a> <div class="header-nav__content-link"> <a href="/us/platform/nexus" class="header-nav__content-link-text">Proofpoint Nexus</a> <div class="header-nav__content-link-desc">Detection technologies to protect people and defend data.</div> </div> <div class="header-nav__content-link"> <a href="/us/platform/zen" class="header-nav__content-link-text">Proofpoint Zen</a> <div class="header-nav__content-link-desc">Protect and engage users wherever they work.</div> </div> </div> </div> <div class="header-nav__menu-pane" data-content="x_sch"> <div class="header-nav__content"> <div class="header-nav__content-title--search"> Search Proofpoint </div> <div class="header-nav__search"> <form class="header-nav__search-form"> <input type="text" class="header-nav__search-input" placeholder=""> <input type="submit" class="header-nav__search-button" val="Search"> </form> <div class="header-nav__search-sugg-title">Try searching for</div> <div class="header-nav__search-suggestions"> <a href="/us/search?content%5Bquery%5D=Email%20Security" class="header-nav__search-suggestion">Email Security</a> <a href="/us/search?content%5Bquery%5D=Phishing" class="header-nav__search-suggestion">Phishing</a> <a href="/us/search?content%5Bquery%5D=DLP" class="header-nav__search-suggestion">DLP</a> <a href="/us/search?content%5Bquery%5D=Email%20Fraud" class="header-nav__search-suggestion">Email Fraud</a> </div> </div> </div> </div> <div class="header-nav__menu-pane" data-content="x_lgn"> <div class="header-nav__content"> <div class="header-nav__content-title"> Select Product Login </div> <ul class="header-nav__logins"> <li class="header-nav__content-login"> <a href="https://proofpoint.my.site.com/community/s/" target="_blank">Support Log-in</a> </li> <li class="header-nav__content-login"> <a href="https://proofpointcybersecurityacademy.adobelearningmanager.com" target="_blank">Proofpoint Cybersecurity Academy</a> </li> <li class="header-nav__content-login"> <a href="https://digitalrisk.proofpoint.com/" target="_blank">Digital Risk Portal</a> </li> <li class="header-nav__content-login"> <a href="https://emaildefense.proofpoint.com/login.php" target="_blank">Email Fraud Defense</a> </li> <li class="header-nav__content-login"> <a href="https://threatintel.proofpoint.com/" target="_blank">ET Intelligence</a> </li> <li class="header-nav__content-login"> <a href="https://us1.proofpointessentials.com/app/login.php" target="_blank">Proofpoint Essentials</a> </li> <li class="header-nav__content-login"> <a href="https://proofpointcommunities.force.com/community" target="_blank">Sendmail Support Log-in</a> </li> </ul> </div> </div> <div class="header-nav__menu-pane" data-content="x_lng"> <div class="header-nav__content"> <div class="header-nav__content-title"> Select Language </div> <ul class="header-nav__language-links"> <li class="header-nav__language-link"> <a href="/us">English (Americas)</a> </li> <li class="header-nav__language-link"> <a href="/uk">English (Europe, Middle East, Africa)</a> </li> <li class="header-nav__language-link"> <a href="/au">English (Asia-Pacific)</a> </li> <li class="header-nav__language-link"> <a href="/es">Español</a> </li> <li class="header-nav__language-link"> <a href="/de">Deutsch</a> </li> <li class="header-nav__language-link"> <a href="/fr">Français</a> </li> <li class="header-nav__language-link"> <a href="/it">Italiano</a> </li> <li class="header-nav__language-link"> <a href="/br">Português</a> </li> <li class="header-nav__language-link"> <a href="/jp">日本語</a> </li> <li class="header-nav__language-link"> <a href="/kr">한국어</a> </li> </ul> </div> </div> </div> </div> <div class="layout-container"> <div> <div data-drupal-messages-fallback class="hidden"></div> </div> <main class="container" role="main"> <a id="main-content" tabindex="-1"></a> <section class="row"> <div class="layout-content"> <div> <div id="block-particle-content"> <article about="/us/threat-reference/multifactor-authentication" class="node--type--glossary node--view-mode--full node node-glossary-full"> <script type="application/ld+json"> { "@context": "https://schema.org/", "@type": "DefinedTerm", "name": "What Is Multifactor Authentication?", "description": "Definition How Multifactor Authentication Works Why Is MFA Important? When Should MFA Be Used?", "url": "https://www.proofpoint.com/us/threat-reference/multifactor-authentication", "inDefinedTermSet": "https://www.proofpoint.com/us/threat-reference" } </script> <div class="glossary-content__breadcrumbs"> <div class="breadcrumbs"><div class="nav-crumbs"><div class="breadcrumb__item"><a href="/us/threat-reference" class="breadcrum__item-link">Glossary</a></div><div class="breadcrumb__item"> What Is Multifactor Authentication? </div></div></div> </div> <div class="glossary-content__hero"> <div class="paragraph paragraph--type--hero-banner-v3 paragraph--view-mode--default hero-banner-v3" style="background-image: url("/sites/default/files/styles/webp_conversion/public/general-banners/pfpt-placeholder-banner-2022.png.webp?itok=E050rqaL")"> <div class="hero-banner-v3__wrapper hero-banner-v3__wrapper-default"> <h1 class="hero-banner-v3__title"> What Is Multifactor Authentication? </h1> <a href=/us/products/information-protection-legacy class="global-elements__cta-button--white" target="" > <span>Information Protection Solutions</span> <div class="global-elements__cta-button--arrow-wrapper"></div> </a> <a href=/us/threat-reference/data-protection class="global-elements__cta-button" target="" > <span>What Is Data Protection?</span> <div class="global-elements__cta-button--arrow-wrapper"></div> </a> </div> </div> </div> <div class="glossary-content"> <h3 class="glossary-content__headline"> Table of Contents </h3> <div class="node-full__body glossary-content__body"> <ul> <li><a href="#toc-1">Definition</a></li> <li><a href="#toc-2">How Multifactor Authentication Works</a></li> <li><a href="#toc-3">Why Is MFA Important?</a></li> <li><a href="#toc-4">When Should MFA Be Used?</a></li> </ul> </div> </div> <div class="glossary__components"> <div class="paragraph paragraph--type--space paragraph--view-mode--full space"> <div class="space__wrapper"> <div class="space__item space__sm"> </div> </div> </div> <span data-smooth-scroll="true" class="anchor_link" id="toc-1"></span> <div class="paragraph paragraph--type--text-columns paragraph--view-mode--full text-cols"> <div class="block-text-cols__cols block-text-cols__cols-1"> <div class="paragraph paragraph--type--text-column paragraph--view-mode--default block-text-cols__cols__item"> <h3 class="block-text-cols__title">Definition</h3> <div class="block-text-cols__body"> <p>To increase the security of user accounts, multifactor authentication (MFA) adds a layer of protection from cyberattacks. Should a anyone phish or <a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="871e15b5-e9bb-4ca6-8419-99399f708071" href="/us/corporate-blog/post/cybersecurity-101-what-social-engineering" title="Cybersecurity 101: What Is Social Engineering?">social engineer</a> a user’s password, the attacker would be unable to authenticate into an account without the secondary authentication requirement. Multifactor authentication provides several options including biometrics, a security token (PIN) or a location signal.</p> </div> </div> </div> </div> <div class="paragraph paragraph--type--space paragraph--view-mode--full space"> <div class="space__wrapper"> <div class="space__item space__md"> </div> </div> </div> <div class="paragraph paragraph--type--free-trial-panel paragraph--view-mode--full free-trial-panel free-trial-panel--black v3-dark-bg-only free-trial-panel--no-img"> <div class="free-trial-panel__wrapper"> <div class="free-trial-panel__content"> <div class="free-trial-panel__heading"> <h3>Cybersecurity Education and Training Begins Here</h3> </div> <a href=# class="global-elements__cta-button--white free-trial-panel__action-btn" > <span>Start a Free Trial</span> <div class="global-elements__cta-button--arrow-wrapper"></div> </a> </div> </div> <div class="free-trial-panel-form"> <div class="paragraph paragraph--type--marketo-form paragraph--view-mode--default marketo-form UNCONVERTED"> <div class="marketo-form__content"> <h2>Here’s how your free trial works:</h2> <ul> <li>Meet with our cybersecurity experts to assess your environment and identify your threat risk exposure</li> <li>Within 24 hours and minimal configuration, we’ll deploy our solutions for 30 days</li> <li>Experience our technology in action!</li> <li>Receive report outlining your security vulnerabilities to help you take immediate action against cybersecurity attacks</li> </ul> <p>Fill out this form to request a meeting with our cybersecurity experts.</p> </div> <div class="marketo-form__form-container"> <div class="mk-form"> <div class="mk-form__form-container"> <script type="IN/Form2" data-data-form="mktoForm_3331" data-field-firstname="FirstName" data-field-lastname="LastName" data-field-email="Email" data-field-company="Company" data-field-title="Title" data-field-state="State" data-field-country="Country" ></script> <form id="mktoForm_3331" data-mkto-id="3331" data-mkto-base="//app-abj.marketo.com" data-munchkin-id="309-RHV-619" data-submit-text="" data-redirect-link="" data-prefill="" data-event-label="" data-lang-code="us" data-validate-email="1" class="mk-form__form marketo-form-block__form" ></form> </div> </div> <div class="mk-form__success"> <p>Thank you for your submission.</p> </div> </div> </div> </div> </div> <div class="paragraph paragraph--type--space paragraph--view-mode--full space"> <div class="space__wrapper"> <div class="space__item space__lg"> </div> </div> </div> <span data-smooth-scroll="true" class="anchor_link" id="toc-2"></span> <div class="utl-disable-bottom-margin paragraph paragraph--type--text-columns paragraph--view-mode--full text-cols"> <div class="block-text-cols__cols block-text-cols__cols-1"> <div class="paragraph paragraph--type--text-column paragraph--view-mode--default block-text-cols__cols__item"> <h3 class="block-text-cols__title">How Multifactor Authentication Works</h3> <div class="block-text-cols__body"> <p>MFA was invented because passwords and usernames are often easy to guess or steal.</p> <p>Computing power has made it faster to brute force passwords. Current computing power allows an attacker to send millions of brute-force attempts per second at a user’s encrypted password. When quantum computing is finally introduced, basic passwords with even the strongest encryption libraries will be rendered obsolete.</p> <p>Another problem with current password workflows is reuse of the same passwords across multiple systems. It’s impossible for users to remember unique 10-character passwords on dozens of systems, so they will often use the same one on multiple platforms. If an attacker can steal the password of one account, it’s possible for the same attacker to breach multiple platforms. Password vaults offer a way for users to store multiple passwords without memorizing them, but breaching a vault creates the same vulnerability.</p> <p>MFA is designed to neutralize brute-force password attacks and <a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="3d41a44d-bc21-401b-8912-4f84e4e683ce" href="/us/threat-reference/phishing" title="Phishing">phishing</a>. There are several ways to deploy MFA, depending on what's used for the secondary authentication requirement, but the basic functionality is the same. Users start with a standard account username and password. With MFA, users also must provide a secondary authentication factor.</p> <p>The most common method in MFA workflows is an access token, usually a one-time password (OTP) sent to the user’s smartphone using text messaging. A personal identification number (PIN) sent to the user’s smartphone is the most common way to add MFA to the authentication process. Most users have smartphones, so it’s a way to ensure that users will be unable to use the MFA system.</p> <p>Multifactor authentication factors must include at least two of the following components:</p> </div> </div> </div> </div> <div class="utl-disable-bottom-margin paragraph paragraph--type--text-columns paragraph--view-mode--full text-cols"> <div class="block-text-cols__cols block-text-cols__cols-2"> <div class="paragraph paragraph--type--text-column paragraph--view-mode--default block-text-cols__cols__item"> <div class="block-text-cols__body"> <ul> <li><strong>Something the user has. </strong>The user could have a physical key, USB device or bank card to identify themselves.</li> <li><strong>Something the user knows.</strong> Generally, this is a memorized password but can be any input only known to the user.</li> </ul> </div> </div> <div class="paragraph paragraph--type--text-column paragraph--view-mode--default block-text-cols__cols__item"> <div class="block-text-cols__body"> <ul> <li><strong>Something the user is.</strong> Biometrics such as fingerprints, voice or eye iris can distinguish user identity.</li> <li><strong>Somewhere the user is located.</strong> Signals from user devices such as GPS location identify that the user is near the system.</li> </ul> </div> </div> </div> </div> <div class="paragraph paragraph--type--space paragraph--view-mode--full space"> <div class="space__wrapper"> <div class="space__item space__sm"> </div> </div> </div> <div class="paragraph paragraph--type--text-columns paragraph--view-mode--full text-cols"> <div class="block-text-cols__cols block-text-cols__cols-1"> <div class="paragraph paragraph--type--text-column paragraph--view-mode--default block-text-cols__cols__item"> <div class="block-text-cols__body"> <p>By using at least two of the above authentication factors, the statistical chances of an attacker having access to both components are very low. Note, however, that the protocol used to send text messages to a user—Signaling System No 7 (SS7)—was <a href="https://www.theguardian.com/technology/2016/apr/19/ss7-hack-explained-mobile-phone-vulnerability-snooping-texts-calls" rel=" noopener" target="_blank">hacked</a> and PINs sent to smartphones can be intercepted. This recent vulnerability in the SS7 protocol has led to organizations moving to other ways of using multifactor authentication using data channels. Targeted <a data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="92be6040-ee07-4e61-acce-006103a6a317" href="/us/corporate-blog/post/three-types-social-engineering-attacks-know" title="Three Types of Social Engineering Attacks to Know">social engineering attacks</a> have been used to convince users to divulge their PINs, giving attackers access to user accounts regardless of MFA.</p> <p>In recent years, commodity phishing tools, also known as phish kits, have gained the ability to circumvent MFA. On one of these phishing sites, the attacker doesn’t just create a facsimile of the login page but uses a lookalike domain name and a transparent reverse proxy to present the victim with real content drawn from the page they expect to see. The victim logs in, seemingly as normal, allowing the attacker to intercept their MFA token and take over the account.</p> <p>Because of the SS7 protocol vulnerability, many companies using MFA have moved towards sending OTP using data channels. Email is one option, but it leaves the user vulnerable should their email accounts get hacked. Using authenticators installed on the user’s device is a better option. Authenticators display PINs that a user can input into the authentication system, which serves as the secondary step during multifactor authentication.</p> <p>Biometrics is a much safer option than using PINs, because this secondary authentication step cannot be intercepted. However, this method has its own disadvantages. Biometric systems are expensive and have not been perfected, making them difficult for users and companies to integrated into their systems. They’ve become much cheaper and have more widespread adoption; they're in almost every modern smartphone, and even desktop PCs have biometric authentication features such as Windows Hello, but they still cannot be integrated as easily on desktop applications.</p> </div> </div> </div> </div> <div class="paragraph paragraph--type--space paragraph--view-mode--full space"> <div class="space__wrapper"> <div class="space__item space__md"> </div> </div> </div> <span data-smooth-scroll="true" class="anchor_link" id="toc-3"></span> <div class="paragraph paragraph--type--text-columns paragraph--view-mode--full text-cols"> <div class="block-text-cols__cols block-text-cols__cols-1"> <div class="paragraph paragraph--type--text-column paragraph--view-mode--default block-text-cols__cols__item"> <h3 class="block-text-cols__title">Why Is MFA Important?</h3> <div class="block-text-cols__body"> <p>MFA was introduced when phishing and social engineering became a primary cyber-attack method. Phishing emails with malicious links, keyloggers, and requests for private credentials are a serious problem for companies and individuals. Phishing attacks that result in credential theft cost companies millions in data breaches. They also create a threat for individuals. If no MFA is included in the authentication process, an attacker with stolen credentials can authenticate into the user’s account.</p> <p>Attackers use social engineering for a variety of reasons, but one of them is to convince users to divulge their account credentials. A simple convincing phone call could give attackers access to high-privilege accounts, which could then lead to a large-scale data breach. In more advanced attacks, an attacker could use a combination of phishing and social engineering to steal credentials.</p> <p>With MFA integrated into an authentication system, phishing and social engineering is mostly neutralized. An attacker could phish user credentials, but they would not have access to the secondary authentication method. They could social engineer a user into divulging account credentials, but again attackers would not have access to the second authentication information.</p> <p>Using secondary authentication methods is mostly effective, but attackers occasionally bypass MFA using social engineering. Attackers that target specific individuals will call them after stealing credentials to convince the targeted user into providing the MFA PIN. Social engineering would not work with biometrics, but most organizations use a PIN as the secondary authentication method. Until biometrics are more widely available, social engineering is still an issue with MFA systems that use PINs.</p> </div> </div> </div> </div> <div class="paragraph paragraph--type--space paragraph--view-mode--full space"> <div class="space__wrapper"> <div class="space__item space__md"> </div> </div> </div> <span data-smooth-scroll="true" class="anchor_link" id="toc-4"></span> <div class="paragraph paragraph--type--text-columns paragraph--view-mode--full text-cols"> <div class="block-text-cols__cols block-text-cols__cols-1"> <div class="paragraph paragraph--type--text-column paragraph--view-mode--default block-text-cols__cols__item"> <h3 class="block-text-cols__title">When Should MFA Be Used?</h3> <div class="block-text-cols__body"> <p>Any website or internal system that stores and works with sensitive data should use MFA. Without MFA added to an authentication workflow, a system accessible to attackers could be vulnerable to brute-force password attacks and credential theft. It’s an added developer expense, so some systems that don’t store sensitive data skip having MFA.</p> <p>Before a developer determines that MFA is not needed, compliance regulations should first be reviewed to ensure there are no regulation violations. Some regulatory standards require MFA on critical systems that store sensitive data. Any system that stores financial data, personal identifiable information (PII), or healthcare data need MFA to authenticate into the network. MFA might not be needed internally, but administrators that authenticate remotely might need to use MFA to stay compliant.</p> <p>Third-party integration options make it easier to include MFA into an authentication workflow. If the system is available to the public where an attacker could possibly authenticate with stolen credentials, MFA should be included in the workflow. Other fraud detection systems can also be used to detect brute-force attacks or stolen credentials, but the first step is using MFA to stop attackers.</p> </div> </div> </div> </div> <div class="paragraph paragraph--type--space paragraph--view-mode--full space"> <div class="space__wrapper"> <div class="space__item space__md"> </div> </div> </div> <div class="paragraph paragraph--type--resources paragraph--view-mode--full resources-block"> <div class="resources-block__wrapper"> <div class="resources-block__inner-wrapper"> <div class="resources-block__heading-wrapper"> <h3 class="resources-block__heading"> Related Resources </h3> </div> <div class="resources-block__resources"> <div about="/us/blog/information-protection/how-to-build-an-information-protection-program" class="node--type--blog-post node--view-mode--teaser-v3 blog-teaser-v3 resource-teaser-v3 UNCONVERTED"> <a class="blog-teaser-v3__url" href="/us/blog/information-protection/how-to-build-an-information-protection-program"> <div class="blog-teaser-v3__image"></div> <h3 class="blog-teaser-v3__type">Blog</h3> <h4 class="blog-teaser-v3__title"> <span>Building a Successful Information Protection Program</span> </h4> </a> </div> <div about="/us/blog/cloud-security/technical-deep-dive-vulnerabilities-bypass-multi-factor-authentication-microsoft" class="node--type--blog-post node--view-mode--teaser-v3 blog-teaser-v3 resource-teaser-v3 UNCONVERTED"> <a class="blog-teaser-v3__url" href="/us/blog/cloud-security/technical-deep-dive-vulnerabilities-bypass-multi-factor-authentication-microsoft"> <div class="blog-teaser-v3__image"></div> <h3 class="blog-teaser-v3__type">Blog</h3> <h4 class="blog-teaser-v3__title"> <span>Technical Deep Dive: MFA Bypass Attacks & How to Protect Yourself</span> </h4> </a> </div> </div> <div class="resources-block__link-wrapper"> <a class="resources-block__link" href="/us/resources"> See more resources </a> </div> </div> </div> </div> <div class="subscribe-block blog-subscribe" data-animate="true"> <div class="subscribe-block__inner blog-subscribe__inner"> <div class="subscribe-block__copy"> <h3 class="subscribe-block__heading"> Subscribe to the Proofpoint Blog </h3> </div> <div class="subscribe-block__form"> <div class="mk-form"> <div class="mk-form__form-container"> <script type="IN/Form2" data-data-form="mktoForm_19277" data-field-firstname="FirstName" data-field-lastname="LastName" data-field-email="Email" data-field-company="Company" data-field-title="Title" data-field-state="State" data-field-country="Country" ></script> <form id="mktoForm_19277" data-mkto-id="19277" data-mkto-base="//app-abj.marketo.com" data-munchkin-id="309-RHV-619" data-submit-text="" data-redirect-link="" data-prefill="" data-event-label="" data-lang-code="us" data-validate-email="1" class="mk-form__form marketo-form-block__form" ></form> </div> </div> </div> </div> </div> <div class="paragraph paragraph--type--space paragraph--view-mode--full space"> <div class="space__wrapper"> <div class="space__item space__md"> </div> </div> </div> <div class="paragraph paragraph--type--cta-banner paragraph--view-mode--full cta-banner cta-banner--bg" data-background-image="/sites/default/files/styles/webp_conversion/public/cta-banner/cta-bkgd.jpg.webp?itok=lGrCI_5c"> <div class="cta-banner__wrapper"> <h2 class="cta-banner__heading"> Ready to Give Proofpoint a Try? </h2> <p class="cta-banner__body">Start with a free Proofpoint trial.</p> <div class="cta-banner__buttons"> <a href=/us/free-trial-request-legacy class="global-elements__cta-button--white" target="" > <span>Get Protected</span> <div class="global-elements__cta-button--arrow-wrapper"></div> </a> </div> </div> </div> </div> <div class="glossary__content-pager"> <div class="content-pager"> <div class="content-pager__items-wrapper"> <div class="content-pager__items"> <div class="content-pager__item content-pager__item--prev"> <a href="/us/threat-reference/multicloud" hreflang="en">Previous Glossary</a> </div> <div class="content-pager__item content-pager__item--next"> <a href="/us/threat-reference/mx-record" hreflang="en">Next Glossary</a> </div> </div> </div> </div> </div> </article> </div> </div> </div> </section> </main> </div> <div class="footer-v3" data-animate="true"> <div class="footer-v3__inner"> <nav class="footer-v3__nav"> <div class="footer-v3__nav-wrapper"> <div class="footer-v3__nav-heading">Products</div> <ul class="footer-v3__nav-collapsible"> <li><a href="/us/products/protect-people">Protect People</a></li> <li><a href="/us/products/defend-data">Defend Data</a></li> <li><a href="/us/products/mitigate-human-risk">Mitigate Human Risk</a></li> <li><a href="/us/products/premium-services">Premium Services</a></li> </ul> </div> <div class="footer-v3__nav-wrapper"> <div class="footer-v3__nav-heading">Get Support</div> <ul class="footer-v3__nav-collapsible"> <li><a href="https://proofpoint.my.site.com/community/s/" target="_blank">Product Support Login</a></li> <li><a href="/us/support-services">Support Services</a></li> <li><a href="https://ipcheck.proofpoint.com" target="_blank">IP Address Blocked?</a></li> </ul> </div> <div class="footer-v3__nav-wrapper"> <div class="footer-v3__nav-heading">Connect with Us</div> <ul class="footer-v3__nav-collapsible"> <li><a href="tel:+1-408-517-4710" class="icon-phone-ppoint">+1-408-517-4710</a></li> <li><a href="/us/events">Attend an Event</a></li> <li><a href="/us/contact">Contact Us</a></li> <li><a href="/us/free-demo-request">Free Demo Request</a></li> </ul> </div> <div class="footer-v3__nav-wrapper"> <div class="footer-v3__nav-heading">More</div> <ul class="footer-v3__nav-collapsible"> <li><a href="/us/company/about">About Proofpoint</a></li> <li><a href="/us/why-proofpoint">Why Proofpoint</a></li> <li><a href="/us/company/careers">Careers</a></li> <li><a href="/us/leadership-team">Leadership Team</a></li> <li><a href="/us/newsroom">News Center</a></li> <li><a href="/us/legal/trust">Privacy and Trust</a></li> </ul> </div> </nav> <div class="footer-v3__bottom-wrap"> <section class="footer-v3__bottom"> <div class="footer-v3__logo"> <a href="/us" class="footer-v3__logo-link"> <div class="footer-v3__logo-image"></div> </a> <div class="footer-v3__bottom-copyright-info">© 2024. All rights reserved. </div> </div> <div class="footer-v3__bottom-copyright"> <a class="footer-v3__bottom-copyright-info" href="/us/legal/license">Terms and conditions</a> <a class="footer-v3__bottom-copyright-info" href="/us/legal/privacy-policy">Privacy Policy</a> <a class="footer-v3__bottom-copyright-info" href="/us/sitemap">Sitemap</a> </div> <ul class="footer-v3__bottom-social-menu"> <li> <a href="http://www.facebook.com/proofpoint" class="icon-facebook" target="_blank"></a> </li> <li> <a href="http://www.twitter.com/proofpoint" class="icon-twitter" target="_blank"></a> </li> <li> <a href="https://www.linkedin.com/company/proofpoint" class="icon-linkedin" target="_blank"></a> </li> <li> <a href="https://www.youtube.com/channel/UCIvtJgsrUzFo90NKeiVozhQ" class="icon-youtube-play" target="_blank"></a> </li> <li> <a href="https://www.instagram.com/proofpoint" class="icon-instagram" target="_blank"></a> </li> </ul> </section> </div> </div> </div> </div> <script type="text/javascript">document.write(unescape("%3Cscript src='//munchkin.marketo.net/munchkin.js' type='text/javascript'%3E%3C/script%3E")); </script> <script>Munchkin.init('309-RHV-619');</script><div class="element-invisible" style="clear:both;">  <script type="text/javascript"> /* <![CDATA[ */ var google_conversion_id = 950296937; var google_custom_params = window.google_tag_params; var google_remarketing_only = true; /* ]]> */ </script> <script type="text/javascript" src="//www.googleadservices.com/pagead/conversion.js"> </script> <noscript> <div style="display:inline;"> <img height="1" width="1" style="border-style:none;" alt="" src="//googleads.g.doubleclick.net/pagead/viewthroughconversion/950296937/?value=0&guid=ON&script=0"/> </div> </noscript></div> </div> <div id="flyout-container"></div> <script type="application/json" data-drupal-selector="drupal-settings-json">{"path":{"baseUrl":"\/","pathPrefix":"us\/","currentPath":"node\/107901","currentPathIsAdmin":false,"isFront":false,"currentLanguage":"en"},"pluralDelimiter":"\u0003","suppressDeprecationErrors":true,"ajaxPageState":{"libraries":"eJxdkFFuAyEMRC8Ugqr-9DaVYR0WrddGtoma25dEVZbtJ29sZjwNFIpCWy0u2hvQtb3JtXPriaqtuFwG9poJYyIp51ewnixrTThxRViy9j3ZAbOwI3toUFBnrNNmdggJmOeJm4ijhvvnhBQxuFag8R0jHUohSYMi4T7M7CSYgT4CyzIZFpFCGG5yGl5H_mHJcD-zymUGKn9hT-EUTbpmtDD6ydshWIM8Wb-L-z_n-OMhC_WdR6b2XT--OBJw6aO6sKBjdtGnsoNu6BL3znndKj-ZIWheY_dKr21fRxXRITGk9DrgzUQogV7sYY57TGD4C-vXzBQ","theme":"particle","theme_token":null},"ajaxTrustedUrl":[],"vwo":{"id":767242,"timeout_library":2500,"timeout_setting":2000,"usejquery":"false","testnull":null},"pp_i18n":{"language":"us"},"instantsearch":{"indexName":"content","path":"us\/search"},"user":{"uid":0,"permissionsHash":"26dd96d39e445e838e5f0382a0a4240ea0629de7ad59c3778594246405e2ccf5"}}</script> <script src="/sites/default/files/js/js_8CW70isSIT32kS0YKfqio8Q45sLJZNysYeCQqB4dtLQ.js?scope=footer&delta=0&language=en&theme=particle&include=eJxdkFFuAzEIRC8Ux6r609tE2Eu8VliwAEfN7euNqq63nzxGzDCt3erHF0cCLh0KhgUds4teWrttoA90iVvnvD4q78wQNK-xeyXbZ19xw-gilEAv9jLHLSYwvDRQr5kwZlGcpJAYUqpcDkURKYThLux20LuIo4bn5yQkMQN9BZbl5MCO7KGND_TAK8Jy8kk6SNa-pbcNFIW2Wly0N6DrQa6dW09UbcVlcnEICZhnixEoAQWk8dopvDXIU8JEUoL1ZFlrmvgfCkORH8dC0aRrRvu_2C8dk-O3hyzUN56bU8TgWkeyBow0V6Ly-8Sp2L2qgRiePyzZzBQ"></script> <script src="https://geoip-js.com/js/apis/geoip2/v2.1/geoip2.js"></script> <script src="/sites/default/files/js/js_DA7GHFg6Iz1O22c58zPl-nNTEwx5y7RuyKjesK1mXJI.js?scope=footer&delta=2&language=en&theme=particle&include=eJxdkFFuAzEIRC8Ux6r609tE2Eu8VliwAEfN7euNqq63nzxGzDCt3erHF0cCLh0KhgUds4teWrttoA90iVvnvD4q78wQNK-xeyXbZ19xw-gilEAv9jLHLSYwvDRQr5kwZlGcpJAYUqpcDkURKYThLux20LuIo4bn5yQkMQN9BZbl5MCO7KGND_TAK8Jy8kk6SNa-pbcNFIW2Wly0N6DrQa6dW09UbcVlcnEICZhnixEoAQWk8dopvDXIU8JEUoL1ZFlrmvgfCkORH8dC0aRrRvu_2C8dk-O3hyzUN56bU8TgWkeyBow0V6Ly-8Sp2L2qgRiePyzZzBQ"></script> <script src="//munchkin.marketo.net/munchkin.js"></script> <script src="/sites/default/files/js/js_Q_hAq3KoriT4uxdUnA3XDouviRgbwswFyj5MCBnzVHU.js?scope=footer&delta=4&language=en&theme=particle&include=eJxdkFFuAzEIRC8Ux6r609tE2Eu8VliwAEfN7euNqq63nzxGzDCt3erHF0cCLh0KhgUds4teWrttoA90iVvnvD4q78wQNK-xeyXbZ19xw-gilEAv9jLHLSYwvDRQr5kwZlGcpJAYUqpcDkURKYThLux20LuIo4bn5yQkMQN9BZbl5MCO7KGND_TAK8Jy8kk6SNa-pbcNFIW2Wly0N6DrQa6dW09UbcVlcnEICZhnixEoAQWk8dopvDXIU8JEUoL1ZFlrmvgfCkORH8dC0aRrRvu_2C8dk-O3hyzUN56bU8TgWkeyBow0V6Ly-8Sp2L2qgRiePyzZzBQ"></script> <script src="/themes/custom/proofpoint/apps/drupal/../../dist/app-drupal/assets/js/app.js?q=jeABoX3ctFM&v=1"></script> <script src="/sites/default/files/js/js_2LYNA9Zu5KE51oXU7U2qX9zbS5cCqO7wzxelxAEWhjk.js?scope=footer&delta=6&language=en&theme=particle&include=eJxdkFFuAzEIRC8Ux6r609tE2Eu8VliwAEfN7euNqq63nzxGzDCt3erHF0cCLh0KhgUds4teWrttoA90iVvnvD4q78wQNK-xeyXbZ19xw-gilEAv9jLHLSYwvDRQr5kwZlGcpJAYUqpcDkURKYThLux20LuIo4bn5yQkMQN9BZbl5MCO7KGND_TAK8Jy8kk6SNa-pbcNFIW2Wly0N6DrQa6dW09UbcVlcnEICZhnixEoAQWk8dopvDXIU8JEUoL1ZFlrmvgfCkORH8dC0aRrRvu_2C8dk-O3hyzUN56bU8TgWkeyBow0V6Ly-8Sp2L2qgRiePyzZzBQ"></script> <script src="//app-abj.marketo.com/js/forms2/js/forms2.min.js"></script> </body> </html>

CINXE.COM

What Is Multifactor Authentication (MFA)? | Proofpoint US