Multi-factor authentication: what it is and where to start.

A password is one way of proving who you are. Multi-factor authentication (MFA) asks for a second, different one. Someone who steals or guesses the password still cannot sign in without it. You may also see it called two-factor authentication or two-step verification.

The three kinds of proof

• Something you know: a password, passphrase or PIN.
• Something you have: a phone with an authenticator app, or a physical security key.
• Something you are: a fingerprint or your face.

MFA means using two from different groups. Two passwords do not count, because both can be stolen the same way.

Which second step to choose

Any second step is far better than none. Some are harder to trick than others. From strongest to weakest:

1. Passkeys and physical security keys. They only work on the real website, so a fake sign-in page cannot use them.
2. An authenticator app that shows a code or asks you to match a number.
3. A code sent by text message or email. Better than nothing, but it can be intercepted or talked out of someone.

Where to turn it on first

1. Email. Whoever controls a mailbox can reset the password of almost everything else.
2. Banking, payroll and accounting.
3. Remote access to the office, including VPNs and remote desktop.
4. Administrator accounts for Microsoft 365, Google Workspace, the website and the domain name.
5. Everything else that offers it.

One habit to keep

If your phone asks you to approve a sign-in that you did not start, decline it and report it. It means someone already has your password. Attackers sometimes send prompt after prompt, hoping one will be approved out of habit.