Turning on multi-factor authentication is the highest-value security change most small businesses can make in an afternoon. It is also the one where the details matter, because not all second factors are equal, and the most common type is the weakest.
The Basic Idea
Multi-factor authentication (MFA, also called two-factor or 2FA) means that knowing your password is not enough to get into your account. Something else is required: a code, a tap on your phone, a physical key. The point is that a stolen or leaked password becomes useless on its own, which matters enormously given how many passwords are already circulating from old breaches.
The Options, Worst to Best
Text message codes: better than nothing, but the weakest link
Codes sent by SMS are the most common form of MFA because they are the easiest to set up and need no app. They do genuinely stop the bulk of automated attacks.
Their weakness is that your phone number is not really under your control. In a SIM swap, someone contacts your mobile carrier, impersonates you convincingly enough, and has your number moved to their device. Your texts, including your security codes, then arrive on their phone. This is not theoretical; it is a routine attack, and it targets people whose accounts are worth money.
Texted codes can also be read from a locked screen, and they can be talked out of you by someone who calls claiming to be from your bank.
If SMS is all a particular service offers, use it. Just do not use it for the accounts that matter most, and ask your mobile carrier to add a port-out PIN to your account, which most now offer for free.
Authenticator apps: the right default for most people
An authenticator app on your phone generates a fresh six-digit code every thirty seconds, with no network connection needed. Because the codes are generated on the device itself, there is no message to intercept and no phone number to hijack.
Any of the well-known apps will do, and several password managers include the feature. The one setup step people skip and later regret: save the backup or recovery codes the service gives you, somewhere that is not your phone. If your phone is lost or replaced and you have neither backup codes nor a synced authenticator app, you are locked out of your own account, and recovering it can take days.
Push approvals: convenient, with one caveat
Some services send a notification you simply approve. It is fast and pleasant, but it created a problem known as MFA fatigue, where an attacker who already has your password triggers approval requests over and over, late at night, until someone taps Approve just to make it stop. Better implementations now show a number on screen that you must match, which fixes this. The rule for everyone: never approve a login you did not personally just start. An unexpected prompt means someone has your password, and it is time to change it.
Hardware security keys and passkeys: the strongest
A hardware key is a small device you plug in or tap to your phone. Passkeys, which we wrote about recently, use the same underlying technology built into your phone or laptop.
What sets these apart is that they are tied to the real website’s address, so they cannot be handed over to a convincing fake login page. Every other method on this list can, in principle, be phished out of a person. These cannot. For the handful of accounts that would be catastrophic to lose, this is the tier worth using.
Where to Turn It On First
Do not try to do everything at once. In order:
- Your email account. Everything else resets through it, which makes it the master key to your whole digital life.
- Your domain registrar and web host. Whoever controls the domain controls the website and the email that runs on it.
- Banking, payroll, and payment processing.
- Your website’s admin login, especially on WordPress, where login pages are attacked continuously by automated software.
- Social media and anywhere customer data lives.
If You Have Staff
Two practical notes. Shared logins undermine all of this, because when several people use one account nobody can enable MFA without disrupting everyone; use proper individual accounts wherever the service allows it. And write down who has access to what, so that when someone leaves you are not trying to remember at short notice.
MFA is not glamorous and it adds a couple of seconds to a login. It also stops the overwhelming majority of real-world account takeovers. If you want help rolling it out across your business accounts without locking anyone out in the process, let us know.