Quick answer
Multi-factor authentication means a stolen password is no longer enough to sign in, which defeats the most common consequence of a breach almost entirely. It does not un-leak anything, it does not protect data already taken, and it does not stop every attack — phishing and stolen session tokens can both get past weaker factors. Turn it on, choose an app or a security key rather than SMS, and keep your passwords unique anyway.
The one idea that makes the rest make sense
MFA changes what an attacker needs. It does not change what has already leaked.
A breach put your address, and possibly your password, into someone else's dataset. Nothing you do afterwards removes it. What MFA does is make that stolen password insufficient on its own: possession of the credential no longer produces access.
Hold onto that distinction and the rest of this article is predictable.
What MFA genuinely stops
Credential stuffing — almost completely
This is the big one, because it is the default consequence of a credential exposure. Attackers take breached address-and-password pairs and try them automatically across many sites, betting on reuse. OWASP names multi-factor authentication as the primary counter-measure, and the reason is structural: the attack has the password and nothing else, so a second factor ends it at the second step.
If you do one thing after a breach, this is the one that closes the largest hole. How credential stuffing works covers the mechanism.
Password spraying and guessing
Same logic. Any attack whose success condition is "obtain the correct password" fails once the password is not sufficient.
Quiet, undetected reuse
You will not remember every site where you used an old password. MFA on the accounts that matter protects those even where you never got round to the change.
What MFA does not do
Being clear about this is not an argument against MFA. It is what stops people treating it as finished business.
It does not undo the exposure
Everything in the breached dataset — your address, your name, your date of birth, the fact that you had an account with that service — is still out. MFA protects the door; it does not retrieve what already left through it. Fields you cannot change stay exposed permanently.
It does not stop phishing on its own
If you are tricked into entering your password and your one-time code into a convincing fake site, an attacker can relay both in real time. CISA's phishing-resistant MFA guidance states that authenticator codes, SMS codes and push notifications are all vulnerable to common bypass techniques, and that a malicious actor can circumvent OTP or SMS protections by tricking users into providing their codes.
FIDO-based authentication is different in kind rather than degree: the credential is bound to the real site's origin, so it will not produce a valid response to a lookalike domain. CISA describes FIDO/WebAuthn as the only widely available phishing-resistant authentication and recommends prioritising migration to it.
It does not stop session theft
Once you have authenticated, your browser holds a session token. Malware or a successful phishing page can steal that token and reuse it without ever needing your password or your second factor. This is one reason "sign out of all sessions" appears in every serious breach-response checklist, and it is why MFA does not remove the need for the rest of the response checklist.
It does not stop MFA fatigue
Repeated push notifications, sent until someone taps approve to make them stop, is a known and effective technique. Number matching — where you must enter a number shown on the login screen — exists specifically to defeat it. Enable it if your provider offers it.
It does not protect a weak recovery path
An account with strong MFA and a recovery flow that accepts a date of birth and the last four digits of a card is protected by the weakest of the two. Attackers know this and go for recovery. Check what your recovery options actually are.
It does not make password reuse safe
Not every account supports MFA, and you will not enable it everywhere. Reuse still spreads exposure to the accounts you missed. Why unique passwords matter covers why this remains the foundational control.
Choosing a factor
Roughly in order of strength.
Hardware security keys and passkeys (FIDO/WebAuthn). The strongest widely available option, and phishing-resistant by design because the credential will not respond to the wrong origin. Use these on email, identity providers and financial accounts where offered.
Authenticator apps (TOTP). Codes generated on your device, not transmitted. Not phishing-resistant — you can still be induced to type the code into a fake page — but immune to SIM swapping and interception. A good default.
Push notification with number matching. Convenient, and the number matching is what makes it materially better than plain push.
Plain push approval. Vulnerable to fatigue attacks. Acceptable if nothing better is offered.
SMS codes. The weakest common form, exposed to SIM-swap and interception. Still far better than no second factor at all — the point is not to refuse SMS, it is not to stop there.
Email codes. Circular if the account being protected is that email account, or if both use the same password.
The fallback trap
This is the most commonly missed detail, and it silently undoes the upgrade.
Enrolling an authenticator app does not usually remove SMS. Both remain valid, so an attacker simply uses the weaker one — and CISA specifically recommends disabling SMS for each account once enrolled in authenticator-based MFA, because enrolment does not automatically unenroll SMS and the leftover creates an exploitable fallback.
After enabling a stronger factor, go back into the security settings and check what else is still accepted. The same applies to backup codes: keep them, store them somewhere a password would be stored, and treat them as credentials rather than as a printout.
What to do after a breach, in order
- Change the exposed password, and change it anywhere it was reused.
- Turn on MFA on your email account first — it is the recovery channel for everything else.
- Then money, then identity documents, then everything else.
- Prefer an app or a security key. Where SMS is the only option, use it.
- Remove weaker fallbacks once a stronger factor is enrolled.
- Save backup codes properly.
- Check recovery settings, which MFA does not protect.
If a password was involved, the immediate question is whether it is on a public list. You can check whether a password is exposed without transmitting it — it is hashed in your browser and only a five-character fragment of the hash is sent.
Frequently asked questions
Is MFA worth it if I already have unique passwords?
Yes. They defend against different things: uniqueness limits the blast radius of a breach, MFA defends against a credential being used at all — including one obtained by phishing rather than by breach.
Is SMS 2FA better than nothing?
Clearly yes. It defeats every attacker who only has your password, which is most of them. The caution is against treating it as equivalent to stronger factors, not against using it.
Should I turn on MFA everywhere?
Everywhere that matters: email, financial accounts, anything holding identity documents, anything with payment details, and work accounts. Below that it is a judgement call about friction.
If I have MFA, do I still need to change a breached password?
Yes. MFA is a second lock, and the first one is currently known to strangers. Locks fail; the account where you forgot to enable MFA is exactly the one that will be tried.
What is a passkey?
A FIDO credential stored on your device or in your password manager, used instead of a password rather than in addition to one. It is phishing-resistant for the same reason a security key is: it is bound to the real site's origin.