Multi-factor authentication (MFA) requires at least two proofs of identity of different kinds: something you know, something you have, or something you are. Even if a password is stolen, the account remains protected. Security keys and authenticator apps resist phishing better than codes received by SMS.
Example
Logging in with the password, then confirming a code displayed by an authenticator app.