MFA for consumer app

If you mean adding MFA to a consumer app, the usual goal is to balance security, conversion, and support load.

Common MFA options for consumer apps

1. TOTP authenticator apps

   • Google Authenticator, Authy, 1Password, etc.
   • Good security, widely supported.
   • Slightly more user friction.

2. SMS codes

   • Easy to adopt, familiar to users.
   • Weaker security than app-based MFA due to SIM swap and interception risks.
   • Often used as a fallback, not the primary method.

3. Email OTP / magic link

   • Very easy for users.
   • Security depends on email account security.
   • Common for lower-risk consumer apps.

4. Push-based MFA

   • Great UX if you have a mobile app.
   • Requires your own app or identity provider support.

5. Passkeys / WebAuthn

   • Best modern option when possible.
   • Strong security and low friction.
   • Great for passwordless or as a second factor, but adoption depends on device/browser support.

Recommended approach for consumer apps

A practical setup is:

• Primary login: password + email verification, or passkeys if possible
• MFA options:
  • Passkeys / WebAuthn as preferred
  • Authenticator app (TOTP) as standard fallback
  • SMS or email OTP only as backup/recovery, if needed
• Recovery: backup codes, trusted device, account recovery flow

Best practices

• Make MFA optional at first unless your app is high-risk
• Prompt users to enable MFA after:
  • account creation
  • sensitive actions
  • sign-in from new device/location
• Offer step-up authentication for payments, profile changes, or data exports
• Support account recovery carefully to avoid locking users out
• Consider risk-based MFA to reduce friction

If you’re choosing one default

• Best security + UX: passkeys
• Best broad fallback: authenticator app (TOTP)
• Best for lowest friction: email OTP, but weaker security

If you want, I can also help with:

• a recommended MFA policy for a consumer app
• UX flow examples
• architecture/design for implementing MFA
• comparison of Auth0, Cognito, Firebase, Clerk, etc.