Which security measure is most effective in preventing credential theft via phishing?

• A. MFA
• B. Firewall
• C. Antivirus only
• D. Backups only

Answer: (A)

Multi-factor authentication adds a second barrier to login beyond just a password. When you require something you have or something you are in addition to something you know, a thief who phishes for your password can’t complete the login on their own. Even if they copy or guess the password, they still need that second factor—like a code from an authenticator app or a hardware security key—which is much harder to obtain or reproduce. This dramatically reduces the risk of credential theft through phishing.

Firewalls protect network boundaries, not the act of stealing credentials via a fake login page. Antivirus helps detect malware but doesn’t prevent a user from entering credentials on a phishing site. Backups guard data after a breach but don’t stop the attacker from obtaining credentials in the first place. Using a strong, phishing-resistant form of MFA (for example, a hardware key) provides even stronger protection, but the core idea is clear: requiring a second factor makes stolen passwords far less useful.