Different kinds of proof
MFA combines different kinds of sign-in proof: something you know (a password), have (a phone or security key), or are (a fingerprint). Two passwords are still one kind.
An authenticator app is generally safer than a text message code. Passkeys and security keys can also resist fake login sites.
Watch for fake prompts
Attackers may trick you into approving a sign-in prompt you did not start, so check each request. Account recovery needs protection too: a weak reset can bypass MFA.