Multifactor authentication (MFA) is a sign-in method that requires two or more different kinds of proof, such as a password plus a code from your phone, before granting access to an account.
MFA, or multifactor authentication, means signing in with two or more kinds of proof instead of just a password. Usually that's your password plus a code from an app, a tap on your phone, or a security key. Even if a criminal steals your password, they can't get in without the second step. Turn it on for email first.
Passwords get guessed, reused and stolen. MFA adds a second lock, so a stolen password on its own doesn't open the door. If you only make one security change this year, this is a strong candidate.
How does MFA work?
MFA asks for proof from at least two different categories, which NIST describes as:
- Something you know, like a password or PIN
- Something you have, like your phone or a security key
- Something you are, like a fingerprint or face scan
After you enter your password, the service asks for the second factor, such as a six-digit code from an authenticator app or a prompt on your phone. Many services remember a trusted device, so you won't be asked every time.
Not all methods are equal. From strongest to weakest:
- Security keys and passkeys (FIDO), which CISA calls phishing-resistant
- Authenticator apps, ideally with number matching for push prompts
- Text message or email codes, which still beat a password alone
Why does MFA matter for small businesses?
Your business email is the master key. It receives password resets for your bank, your website, your domain and your payroll. If someone gets into it, they can often get into everything else, and send convincing business email compromise requests from your real address.
CISA says users who enable MFA are significantly less likely to get hacked, because a stolen password alone no longer meets the sign-in requirement.
How do I set up MFA?
CISA's steps work for most services: open your account settings, find the security section, and turn on the option called two-factor authentication, 2-Step Verification or similar. Then choose your method.
Start with the accounts that unlock others. That means email first (Google Workspace or Microsoft 365, for everyone on the team), then banking and payment apps, your domain registrar and DNS host, your website admin and hosting account, and payroll and accounting software.
In Google Workspace, an admin can require 2-Step Verification for everyone. Our Google Workspace security guide shows how.
MFA vs 2FA
2FA is simply MFA with two factors, which is what most services use. The names are interchangeable in practice.
CyberVigil's checks are outside-in, so we can't see whether MFA is on for your accounts. A free CyberVigil scan covers the website and email settings we can check, and our cybersecurity checklist covers MFA and the rest.
Common questions
Is 2FA the same as MFA?
Yes, for everyday purposes. Two-factor authentication (2FA) is MFA with exactly two factors. Services also call it 2-Step Verification or two-step authentication.
Are text message codes good enough?
They're much better than a password alone. CISA says any MFA is better than no MFA, but an authenticator app or a security key is stronger than codes sent by text, which can be intercepted.
What if I lose my phone?
Set up backup options when you turn MFA on, such as printed backup codes or a second device, and store them somewhere safe. For business accounts, make sure more than one trusted person can recover admin access.
Sources
- Multi-factor authentication (glossary) (NIST Computer Security Resource Center)
- More than a Password (Cybersecurity and Infrastructure Security Agency (CISA))
- Turn On MFA (Cybersecurity and Infrastructure Security Agency (CISA))
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.