Multi-factor authentication, explained in plain English

What multi-factor authentication actually is

A password proves you know something. Multi-factor authentication (MFA) (show definition) adds a second proof, usually something you have, like your phone, or something you are, like a fingerprint. If someone steals your password, they still need that second piece to get in.

Most account breaches start with a stolen or guessed password. MFA doesn't make you unbreakable, but it stops a large share of these attacks cold, because the attacker rarely has your phone or security key too.

The main types, from weakest to strongest

• Text message (SMS) codes: better than nothing, but phone numbers can be hijacked through a scam called SIM swapping.
• App-generated codes: a free app on your phone generates a new six-digit code every 30 seconds. No cell signal needed.
• Push notifications: the app sends a prompt to approve or deny. Fast, but vulnerable to a trick called push fatigue.
• Security keys: a small physical device you plug in or tap. Currently the strongest widely available option for regular businesses.

Where to turn it on first

1. Email accounts. Email is usually the recovery method for every other account, so it needs the strongest protection you have.
2. Online banking and any account tied to moving money.
3. Remote access tools, like VPN or remote desktop, that reach your business network from outside the office.
4. Any admin or owner-level account for your website, payroll, or cloud storage.
5. Everything else, working outward from there.

A short checklist for your team

• MFA is turned on for every email account, including shared mailboxes
• MFA is turned on for online banking and payroll
• MFA is turned on for remote access tools
• Text-message codes are being phased out in favor of an app or security key
• Employees know who to call if they get a login prompt they didn't request

What to do if you get a prompt you didn't request

Deny the prompt. Do not approve it out of habit. Then change that account's password right away and tell whoever manages your IT or security. A repeated flood of prompts usually means someone already has your password and is trying to get past the second step.