What is 'Multi-Factor Authentication' (MFA) and why does it substantially increase security over single-factor?

• A.MFA requires two passwords from separate categories: a login password (something you know), a transaction PIN (something you know), or a recovery phrase (something you have). An attacker who steals the first password never gets past the second prompt, with the categories differing in how they are entered on the login page
• B.MFA requires two or more distinct categories of authentication factor: something you know (password), something you have (authenticator app, hardware key), or something you are (biometrics). An attacker who steals a password still cannot authenticate without the second factor
• C.MFA requires one factor from a trusted network zone: a corporate IP (something you have), a VPN login (something you are), or a badge scan (something you know). An attacker on a different network cannot reach the prompt from outside the zone, a rule that mirrors how network access lists are written
• D.MFA means passwords are rotated at each login: a one-time value (something you know), replacing the previous password each time. An attacker who steals a password never reuses it on another site