Proving who you are — factors, proofing & assurance

A password alone is weak. Today a login uses layers of proof, and systems also check that the account belongs to a real person. Your goal: name the three kinds of proof and say what MFA, passkeys and assurance mean.

The three kinds of proof, and MFA

Each kind of proof is called a factor.

Multi-factor authentication (MFA) means you need two or more different kinds. A password plus a code from your phone is MFA. A password plus a security answer is not. Both are "something you know". An ATM is a good picture: the card is what you have, and the PIN is what you know.

Passkeys: no password

A passkey is a pair of keys. The private key stays on your device. Your fingerprint or face unlocks it. The private key never goes to the website. So there is no password to guess, reuse or trick out of you. A passkey is phishing-resistant.

Step-up: more proof for risky actions

Step-up authentication means the system asks for more proof only when an action is risky. Reading your balance? You stay signed in. Sending ₹25,000? You first confirm on your phone, as a UPI app asks for your PIN. The tokens lesson shows how this works.

Identity proofing: is the person real?

Authentication checks that you own an account. Identity proofing checks that the account belongs to a real, verified person. It can mean scanning an ID document, matching a selfie to it with a liveness check, or checking official records. Done online, it is called eKYC. Many banking apps use it when you open an account without visiting a branch.

Assurance: trust as a number

Proof has different strengths, so we can score it. An assurance level is that score. There is one score for each question.