MFA protects against phishing by requiring additional forms of verification beyond just a password. Even if a user falls victim to a phishing attack and reveals their password, the attacker will still be unable to access the system without the additional forms of verification. This approach prevents attackers from using stolen passwords to gain unauthorized access.