Also called: 2FA, One-Time Password (OTP), OTP, SMS verification, Two-Factor Authentication
What multi-factor authentication is
Multi-factor authentication (MFA) verifies a person using two or more independent types of evidence. The factors fall into three categories: something you know, such as a password or PIN; something you have, such as a phone; and something you are, such as a fingerprint.
Two-factor authentication (2FA) uses exactly two factors, so it is one form of MFA. A one-time password (OTP) is a code used for one login or transaction. SMS verification describes sending a code by text, not a separate factor category. A password plus a text code is one common two-step example.
A password protects the account until someone steals it. MFA makes that password alone insufficient.
Where you encounter it
Your payment portal, administrator login, or other system holding card data may use MFA to stop someone with a stolen password from getting in. EMVCo published security requirements for payment MFA solutions on August 7, 2023, covering security evaluation of the software and hardware involved in payment authentication.
For U.S. merchants, PCI DSS v4.0.1 requires MFA for all access into the cardholder data environment as of 2026. This is a security control for system access. It does not mean every customer must complete MFA at checkout for every card payment.
What it means for your costs
MFA has no standard standalone card-processing fee in the available fee information. A separate security product or service could have its own price, so distinguish that from network and processor charges on your payment bill.
One exception to watch is a bundled network charge. As of April 6, 2026, Mastercard includes MFA-related services, Identity Check and Passkeys, in its Digital Enablement Fee (DEF), billed at authorization. The DEF is a bundle, not an MFA-only charge, and its published rate does not identify a separate price for MFA. Do not treat the full DEF as an MFA fee.
Why it matters to your business
A compromised administrator account can expose customer payment information or let an unauthorized user change payment settings. MFA adds another barrier after a password is exposed, reducing the chance that one stolen credential is enough to access payment systems.
MFA does not remove your PCI DSS responsibilities or guarantee that a payment is legitimate. Your practical goal is to protect system access without adding unnecessary steps to routine customer checkout.
What you can actually change
- Protect sensitive access. Enable MFA for payment, administrator, and card-data systems. PCI DSS v4.0.1 requires MFA for all access into the cardholder data environment as of 2026.
- Separate bundled charges. If your bill includes Mastercard's DEF, compare the authorization fee with the applicable rate schedule. The fee bundles services and does not show a standalone MFA price.
- Review checkout friction. Keep staff and administrator login controls separate from customer checkout steps. Add customer verification where it fits your payment flow and security needs.
Frequently asked questions
Is MFA the same as two-factor authentication?
No. MFA means two or more independent factors. Two-factor authentication uses exactly two, making 2FA a type of MFA. A password plus a code sent to your phone is a common example.
Is a one-time password the same as MFA?
No. An OTP is a code intended for one login or transaction. It can serve as one factor in an MFA process, such as when a system asks for a password and then sends a code by text.
Does MFA add a card-processing fee?
There is no standard standalone card-processing fee for MFA in the available fee information. As of April 6, 2026, Mastercard includes MFA-related services in its bundled Digital Enablement Fee, which is billed at authorization.
Does every U.S. customer have to use MFA at checkout?
No general U.S. checkout requirement is established in the research notes. PCI DSS v4.0.1 requires MFA for access into the cardholder data environment as of 2026, which is a system-access control rather than a rule requiring MFA for every customer purchase.