Two-Factor Authentication (2FA)

What 2FA means

Two-Factor Authentication, shortened to 2FA, means verifying your identity with exactly two different types of proof. A password plus a one-time code sent to your phone is one example. The name is common in account security and describes a specific version of multi-factor authentication, or MFA, which covers two or more factors.

You will see 2FA settings when signing in to payment dashboards, online banking, or other systems that handle business data. For access to the cardholder data environment, PCI DSS requires MFA. As of 2026, the current standard is PCI DSS v4.0.1, and its future-dated requirements became mandatory on March 31, 2025. 2FA itself is not a standard card-processing fee, though processors commonly bill a monthly PCI non-compliance fee when you have not validated compliance. The rest of this page explains the broader term, multi-factor authentication.

What multi-factor authentication is

Multi-factor authentication (MFA) verifies a person using two or more independent types of evidence. The factors fall into three categories: something you know, such as a password or PIN; something you have, such as a phone; and something you are, such as a fingerprint.

Two-factor authentication (2FA) uses exactly two factors, so it is one form of MFA. A one-time password (OTP) is a code used for one login or transaction. SMS verification describes sending a code by text, not a separate factor category. A password plus a text code is one common two-step example.

A password protects the account until someone steals it. MFA makes that password alone insufficient.

Where you encounter it

Your payment portal, administrator login, or other system holding card data may use MFA to stop someone with a stolen password from getting in. EMVCo published security requirements for payment MFA solutions on August 7, 2023, covering security evaluation of the software and hardware involved in payment authentication.

For U.S. merchants, PCI DSS v4.0.1 requires MFA for all access into the cardholder data environment as of 2026. This is a security control for system access. It does not mean every customer must complete MFA at checkout for every card payment.

What it means for your costs

MFA has no standard standalone card-processing fee in the available fee information. A separate security product or service could have its own price, so distinguish that from network and processor charges on your payment bill.

One exception to watch is a bundled network charge. As of April 6, 2026, Mastercard includes MFA-related services, Identity Check and Passkeys, in its Digital Enablement Fee (DEF), billed at authorization. The DEF is a bundle, not an MFA-only charge, and its published rate does not identify a separate price for MFA. Do not treat the full DEF as an MFA fee.

Why it matters to your business

A compromised administrator account can expose customer payment information or let an unauthorized user change payment settings. MFA adds another barrier after a password is exposed, reducing the chance that one stolen credential is enough to access payment systems.

MFA does not remove your PCI DSS responsibilities or guarantee that a payment is legitimate. Your practical goal is to protect system access without adding unnecessary steps to routine customer checkout.

What you can actually change

1. 01
   Protect sensitive access. Enable MFA for payment, administrator, and card-data systems. PCI DSS v4.0.1 requires MFA for all access into the cardholder data environment as of 2026.
2. 02
   Separate bundled charges. If your bill includes Mastercard's DEF, compare the authorization fee with the applicable rate schedule. The fee bundles services and does not show a standalone MFA price.
3. 03
   Review checkout friction. Keep staff and administrator login controls separate from customer checkout steps. Add customer verification where it fits your payment flow and security needs.

Frequently asked questions