Multi-factor authentication (MFA) uses factors from different categories to verify identity. In Joomla, an additional check helps protect an account when its password becomes known to someone else.
Authentication factors
Factors involve something a person knows, possesses or is. A password and another password are in the same category and do not form two independent factors. A common combination is a password and a TOTP code from an authenticator app.
Methods differ in phishing resistance and recovery behaviour. Attackers can trick people into sharing message codes, so verification methods do not all provide identical protection.
MFA in Joomla
The Joomla version and enabled plugins determine available MFA methods. User options control how additional verification is applied. Having a method installed does not mean it is configured for a particular account.
Before enforcing MFA in Joomla, test sign-in, a backup method and recovery. Store recovery codes separately in a protected place. Do not publish them or share them with the password.
Conclusion
MFA strengthens identity verification. Reliable use requires a suitable method, tested sign-in and a prepared recovery process.