Multi-Factor Authentication: Accounts and Signing

Multi-factor and two-factor authentication

Authentication using different factor types, with a distinction between protecting a signing account and checking an external recipient.

Sarah Mitchell

Published on

2026-11-06

Last updated on

MFA requires distinct factor types, not simply two screens or two secrets.
Account 2FA does not automatically impose the same checks on signing recipients.
Not all MFA methods are phishing-resistant or proof of real-world identity.

What is multi-factor authentication?

Multi-factor authentication (MFA) requires proof of control of two or more distinct factor types. Two-factor authentication (2FA) uses two. The number of screens or codes does not determine whether a process is MFA.

What counts as a factor?

Something you know: a secret such as a password.
Something you have: an authenticator or device whose control is checked.
Something you are: a biometric characteristic used within an appropriate authentication process.

A password followed by another password or PIN is not automatically two-factor authentication: both are knowledge factors. A one-time code’s meaning depends on how it is generated, delivered and bound to the account or transaction. NIST treats biometrics as part of authentication with a physical authenticator, rather than a standalone secret.

Account MFA versus recipient checks

Account MFA protects entry to the signing service. Sign.Plus documents account 2FA using a password and authenticator-app code. Activating it does not automatically require an external signer to use the same factor combination.

Recipient authentication belongs to the particular signing request. A link and passcode delivered through the same mailbox should not automatically be described as independent factors. Establish what each check proves and which person or account it protects.

Does MFA prevent every attack?

No. NIST’s authentication guidance distinguishes phishing-resistant methods from manually entered codes that can be relayed by an attacker. MFA does not by itself establish a verified real-world identity, appropriate document permissions or authority to sign an agreement.

For a signing process, choose the required protection around the account and recipient risks. Do not substitute a generic “MFA enabled” label for understanding the actual controls.

A Common Case: Protecting a sender account separately

A Texas real-estate company’s administrator might enable authenticator-app 2FA for their signing account. When sending a client agreement, the team would still choose the recipient checks appropriate to that request instead of assuming the administrator’s login protection also authenticates the client.