Multi-factor authentication (MFA) is an IT security mechanism that requires users to provide at least two forms of verification to access a system - application - or data. MFA involves a combination of something the user knows (their password) - something the user has (like a smartphone or other device authentication token) - and something they are (a personal signifier like a fingerprint or facial recognition).