← Years 7–8 Digital Systems

Types of MFA

Ways to prove it's you: an SMS code, an authenticator app, a biometric like a fingerprint, or a physical security key. They differ in how easy they are to use and how strong they are.

Part of: 7-8 Digital Technologies Vic Curric - Digital Systems and Security — Module 59, 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 29, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 54, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 42, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 41, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 108

Understanding Types of MFA in Years 7–8 Digital Systems

What it does: Fingerprints and face scans are biometrics. You do not need to remember or type anything. A security key is a physical object that you must have with you. It only works with the real website, so fake sites cannot trick it. An SMS code is a text message with a short one-time number. It is easy to use, but a scammer can sometimes steal or redirect the message. Biometrics use something about your body, like a fingerprint or your face. They are quick and you can't forget them. A security key is a physical device, like a USB stick. It is one of the strongest MFA types, because a scammer far away can't copy it.

Common mistakes: An SMS code is sent to your phone as a text message. It is an authenticator app that makes codes on your device. It should say: SMS code: sent as a text. A security key is a physical device, not a biometric. A biometric uses your body, such as a fingerprint. It should say: example = fingerprint.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Types of MFA to a class →

This module's key terms are also in a printable crossword (Modules 26–74) and word search (Modules 4–74).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which MFA method sends a one-time code to your phone number as a text message?
Security keySMS code
Matches
A caller says they are from your bank, so you read out your SMS code.
↓
Never share a code with anyone. Scammers ask for it so they can log in as you. Only type it into the real app or website yourself.
Applying
Meanings
Term
MFA methods
Meaning
Ways to prove it's you: an SMS code, an authenticator app, a biometric like a fingerprint, or a physical security key. They differ in how easy they are to use and how strong they are.
Practice
SMS code: easy to use, but can be intercepted
Testing
Gaps
A text message code is called an code
Check Answer
Spots
1SMS code: made inside an app
2App code: made on your phone

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Sperm Whale' badge — Deep Sea Champion, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which MFA method sends a one-time code to your phone number as a text message?
A. Security key
B. SMS code ✓
An SMS code is a text message with a short one-time number. It is easy to use, but a scammer can sometimes steal or redirect the message.
2. Which is generally STRONGER than an SMS code?
A. A text message sent over the phone network
B. An authenticator app that makes codes on your device ✓
An authenticator app makes codes on your own device, so they can't be intercepted as a text message. That makes it harder for a scammer to steal them.
3. A fingerprint or face scan is an example of which type of MFA?
A. Biometric ✓
B. Security key
Biometrics use something about your body, like a fingerprint or your face. They are quick and you can't forget them.
4. True or false: A physical security key is a small device you plug in or tap to prove it's you.
A. True ✓
B. False
A security key is a physical device, like a USB stick. It is one of the strongest MFA types, because a scammer far away can't copy it.
5. Which MFA type is usually the MOST convenient for a quick unlock on your phone?
A. Fingerprint or face scan ✓
B. Typing a long code from a security key
A fingerprint or face scan takes only a second and there is nothing to type. That makes biometrics very convenient.

Match the Pairs

SMS code → A number texted to your phone. It is easy to use, but it can be intercepted or tricked out of you, so it is the weakest of the four.
Authenticator app → An app on your device that makes a new code every 30 seconds. It is stronger than SMS because the code is not sent by text.
A biometric uses part of your body to prove it is you, and it is quick and easy to use. → Fingerprint or face scan
A physical security key is a small device you plug in or tap. It is the strongest option, even against fake websites. → USB security key
A caller says they are from your bank, so you read out your SMS code. → Never share a code with anyone. Scammers ask for it so they can log in as you. Only type it into the real app or website yourself.
All MFA types are equally strong, so an SMS code is as safe as a security key. → MFA types differ. SMS codes can be intercepted or tricked out of you, while a physical security key is much harder to break.

Key Term

MFA methods
Ways to prove it's you: an SMS code, an authenticator app, a biometric like a fingerprint, or a physical security key. They differ in how easy they are to use and how strong they are.

Fill in the Blanks

1. A text message code is called an SMS code
Hint: Type the short name for a text message
2. Code from an authenticator app
Hint: Type the word for the app that creates MFA codes
3. Fingerprint and face scan are biometrics
Hint: Type the word for checks based on your body
4. A USB security key is a physical MFA method
Hint: Type the word that describes this kind of key
5. SMS codes can be intercepted, so are weaker
Hint: Type the word that compares SMS strength to a security key

Spot the Error

Question 1
A SMS code: made inside an app
B App code: made on your phone
C Key: plug in or tap to log in
Line A — An SMS code is sent to your phone as a text message. It is an authenticator app that makes codes on your device. It should say: SMS code: sent as a text.
Question 2
A type = biometric
B example = security key
C uses = your body
Line B — A security key is a physical device, not a biometric. A biometric uses your body, such as a fingerprint. It should say: example = fingerprint.
Question 3
A key = physical device
B plug in USB or tap NFC
C phishing_protection = none
Line C — Security keys give strong protection against phishing because they only work with the real website. It should say: phishing_protection = strong.
Question 4
A SMS: code arrives by text
B App: needs mobile signal
C Both: code expires quickly
Line B — An authenticator app makes codes on the device, so it works without mobile signal. SMS needs signal to receive the text. It should say: App: works with no signal.
Question 5
A login = password + 2nd step
B step = SMS code
C risk = SIM swap can steal it
D fix = use SMS only
Line D — SMS codes can be stolen with a SIM swap, so using SMS only does not fix the risk. A stronger method like an authenticator app or security key does. It should say: fix = use an app or key.

Student with a class code? Join your class →