Multi-factor authentication, or MFA, is a login control that asks for more than one proof of identity before granting access. Those proofs usually combine something you know, such as a password, with something you have, like a phone prompt or hardware token, or something you are, such as a fingerprint.
MFA matters because stolen passwords alone are often enough for attackers to enter email, cloud apps, payroll systems, and client portals. In extortion and ransomware-adjacent attacks, MFA can block credential stuffing, phishing, and reused-password attacks, or at least force criminals to steal a second factor. Defenders use MFA as a core control for remote access, administrator accounts, and sensitive business tools. It is strongest when paired with phishing-resistant methods, least privilege, and alerts for unusual login attempts.