Why one factor stopped being enough
A password alone proves that someone typed the right string, not that the right person typed it. Passwords are reused across services, guessed, phished, and leaked in bulk from unrelated breaches — all without the account holder doing anything wrong. Multi-factor authentication closes most of that gap by requiring a second, independent kind of proof: something the principal has or is, not just something it knows.
The strength of the second factor varies widely. A one-time code delivered by text message is meaningfully weaker than a hardware key that never transmits a secret over the network, because the delivery channel itself can be attacked. Choosing which factor to require is a real security decision, not a box to check once and forget.
Fixed verification versus verification that scales with stakes
Requiring the same authentication strength for every action in a session treats logging in and changing account recovery settings as equally sensitive, which they plainly are not. Step-up authentication asks for stronger proof only at the moment an action becomes higher-stakes — reauthenticating, or requiring a second factor that wasn't needed for the session's routine activity.
This keeps routine use fast while still raising the bar exactly where it matters. The alternative — a uniformly high bar for everything — tends to train people to treat the extra step as friction to click through quickly, which defeats its purpose for the actions that actually needed the scrutiny.