MFA - Time Based One time password

TOTP (Time-based, One-Time Password) is a form of MFA that uses a randomly generated code as an additional authentication token.

Each TOTP code is only valid for a short amount of time and constantly refreshed, meaning that the perpetrator of a breach would need both a user’s compromised credentials and direct access to their phone in order to take over their account.

Comparing TOTP to SMS-Based MFA

SMS-based MFA uses codes similar in structure to those of TOTP, except instead of being generated directly on a smartphone, they’re sent via SMS text message, which means they’re being created outside of the device. Although usually generated by a trustable source, an insider attacker could potentially route the code to themselves. 

Additionally, SMS codes often last longer than TOTP codes. While this makes them easier to leverage by end users, intercepted SMS codes give a wider time frame for bad actors as well. As such, many consider SMS to be one of the least secure methods of MFA.