What is the difference between single-factor and multi-factor authentication, and when do two means NOT count as multi-factor?
Single-factor authentication uses one factor category, multi-factor authentication (MFA) uses at least two distinct categories; several means from the same category, such as a password plus a PIN, are still single-factor.
What makes MFA strong is independence: each factor must be broken by a different kind of attack. A password and a security question are both "something you know", so a phishing page or keylogger captures both at once. That is why NIST states explicitly that multiple instances of the same factor still constitute single-factor authentication.
Examples:
| Combination | Factors | MFA? |
|---|---|---|
| Password + PIN | know + know | No |
| Password + code from an authenticator app | know + have | Yes |
| Smartcard + PIN | have + know | Yes |
| Phone unlocked by fingerprint, holding a passkey | have + are | Yes |
| Two different hardware tokens | have + have | No |
Tip: Ask "could one single attack capture both?" If yes, it is not real MFA, whatever the login screen calls it.
Go deeper:
NIST SP 800-63-4: Authenticators — the statement that a PIN and a password together are still single-factor.- OWASP Multifactor Authentication Cheat Sheet — factor types, their pros and cons, and implementation advice.
Why You Should Turn On Two Factor Authentication (Tom Scott, YouTube) — why a second factor stops most account takeovers.