iRealtee OS Glossary

Multi-Factor Authentication

1. **User initiates login**: The user enters their username and password (first factor) 2. **System validates credentials**: The system checks if the password m...

Multi-Factor Authentication

Multi-Factor Authentication (MFA) is an electronic authentication method that grants a user access to a system only after successfully presenting two or more distinct types of verification evidence. MFA combines multiple authentication factors—typically something you know (password), something you have (mobile device or token), and something you are (biometrics)—to establish user identity.

Key Components

  • Knowledge Factor: Information the user knows, such as a password, PIN, or security question answer
  • Possession Factor: A physical item the user has, such as a mobile phone for SMS OTP, a hardware token, or an authenticator app
  • Inherence Factor: Biometric characteristics unique to the user, such as fingerprints, facial recognition, or voice patterns

How it Works

  1. User initiates login: The user enters their username and password (first factor)
  2. System validates credentials: The system checks if the password matches stored credentials
  3. Second factor requested: Upon successful password validation, the system prompts for a second verification method
  4. OTP delivery: For SMS-based MFA, a one-time password is sent to the registered mobile number
  5. User submits OTP: The user enters the received code within its validity window (typically 5-10 minutes)
  6. Access granted: After both factors are verified, the user gains access to the account

Pros & Cons

Advantages:

  • Significantly reduces unauthorized access risk even if passwords are compromised
  • Meets Data Privacy Act of 2012 (RA 10173) compliance requirements under NPC Circular 16-01
  • Protects sensitive client and property transaction data
  • Low implementation cost when using SMS-based OTP

Disadvantages:

  • SMS delivery delays can frustrate users during login
  • Requires users to have access to their registered mobile device
  • SIM-swapping attacks can compromise SMS-based verification
  • Additional login step increases time to access the system

Real-World Application

In the Philippine real estate industry, MFA protects agent accounts containing sensitive buyer information, property listings, and commission records. Real estate brokerages using platforms like iRealtee implement MFA to secure:

The National Privacy Commission (NPC) requires organizations handling personal information to implement MFA under NPC Circular 16-01, Section 18. This applies to all PRC-licensed real estate service practitioners accessing client data online.

You can configure MFA settings through the Account Security and OTP Verification features to enforce two-step verification for all agent logins.

References

Looking for another term? Browse the full glossary.

Back to Glossary