You are the Network Administrator for a bank. In addition to the usual security issues, you are concerned that your customers could be the victim of phishing attacks that use fake bank Web sites…

Three-factor authentication verifies the user's identity to the server but places no requirement on the server to prove its own identity to the user, so a convincing fake site can still collect the user's credentials.

Two-factor authentication adds a second credential layer for user login but still does not require the server to authenticate itself to the client, leaving users exposed to entering valid credentials on a phishing site.

Mutual authentication (also implemented as mutual TLS) requires the server to present a valid digital certificate proving its identity to the client before any session is established, and the client must also authenticate to the server. A fraudulent phishing site impersonating a bank cannot obtain a legitimate certificate issued for the real bank's domain from a trusted Certificate Authority, so the mutual authentication handshake will fail and the user's browser will reject the fake site. This two-way verification directly closes the trust gap that phishing attacks exploit.

MAC (whether Message Authentication Code or MAC address filtering) addresses data integrity or network access control at the hardware layer and provides no mechanism for verifying the identity of a remote website to an end user.