Verification depends on a secret key
A sender computes a tag under a specified algorithm and key, and a receiver checks it with the shared secret. An outsider knowing the algorithm should find it difficult to produce an accepted tag for an unauthorized new message.
An unkeyed checksum or digest has different conditions: someone replacing a message can normally recompute its public check. A MAC adds a protected secret through a designed construction, with security depending on the algorithm, key, tag length and usage limits.
Authentication and confidentiality are separate
A plaintext message can carry a MAC, so successful tag verification does not imply that the contents were hidden in transit. Confidentiality needs suitable encryption or an authenticated-encryption construction rather than treating the tag as ciphertext.
A shared-key MAC also differs from a public-key signature: a verifier normally has the ability to generate tags too. The tag alone therefore does not identify to an outside party which key-sharing participant authored the message. Identity and authorization require the surrounding protocol.
The protocol determines what is authenticated
A MAC covers only the supplied bytes. Authenticating an amount does not automatically bind an omitted recipient, operation or context, and encoding must distinguish different field combinations. The algorithm cannot infer business-critical context.
Replaying an unchanged valid message and tag can still pass the mathematical check. Anti-replay requires the protocol to bind and check sequence numbers, challenges or other freshness conditions with suitable state; merely adding an unchecked time field is insufficient.