Multi-factor authentication (MFA) means proving who you are in two or more different ways when you log in, so that a stolen password alone is not enough to get in. When there are exactly two ways, it is often called two-factor authentication, or 2FA. Each way of proving is called a factor.
There are three kinds of factor. The first is something you know, such as a password or a PIN. The second is something you have, such as your phone or a small hardware key. The third is something you are, such as your fingerprint or your face. MFA combines factors of different kinds. A password and a security question are both things you know, so together they are not MFA.
The second factor takes several forms. A one-time password, or OTP, can arrive by SMS. An authenticator app on the phone can show a six-digit code that changes every 30 seconds. The app and the server both calculate the same code from a shared secret and the current time. A push notification can ask you to tap Approve on your phone. A hardware token is a key-ring device that shows a new code every minute. For years, banks gave such tokens to their corporate customers. A security key, or a passkey stored on the phone, proves who you are with a cryptographic key that never leaves the device.
Consider a site engineer at a construction company in Bhubaneswar. She types her email password into a fake login page that an attacker has sent her. Ten minutes later, the attacker, in another country, types the stolen password into the real login page. The company's MFA sends a prompt to her phone. It asks her to type the two-digit number that is shown on the login screen. She has not tried to log in, and she sees no number, so she does not approve. The attacker has the password but cannot get in. She reports the prompt, and the IT team resets her password.
Not every factor is equally strong. An SMS code can be stolen by a fake login page that asks for the code too, or by moving the phone number to a new SIM card. Push prompts can be abused: the attacker sends dozens of them until a tired person taps Approve. Asking for a number, as in the example, prevents this. Security keys and passkeys resist phishing, because they check the website's real address before they answer.
MFA usually runs inside single sign-on (SSO). It also protects remote connections through a VPN, and administrators' logins through privileged access management (PAM). Banks use the same idea for their customers. A bank's app checks a second factor at login, and many online payments in India need an OTP, which banks send through OTP verification services.