MFA typically works by requiring users to first enter their username and password. After this, they must provide one or more additional forms of authentication. This could be a code sent to their mobile device, a fingerprint scan, or a hardware token. Authentication methods vary depending on the platform’s capabilities and the user’s preference.