Multi-Factor Authentication Explained (and Why It's Worth the Minor Hassle)

If you've been asked to approve a login on your phone after typing a password somewhere, you've already used multi-factor authentication, often shortened to MFA (or sometimes two-factor authentication, 2FA). It's one of the simplest security controls available, and consistently one of the most effective — which is why it's worth understanding properly rather than just clicking "approve" on autopilot.

The basic idea

MFA means proving who you are using more than one type of evidence. Usually that's something you know (a password) combined with something you have (a code sent to your phone, or an approval through an authenticator app) or something you are (a fingerprint or face scan on a device that supports it). The point is that a password alone — even a strong one — is no longer enough on its own to get into the account.

Why this matters so much in practice

Passwords leak. They get exposed in breaches at other websites, guessed, or handed over through a convincing phishing page, often without the account owner realising straight away. Without MFA, a leaked password is often all an attacker needs to log straight in. With MFA switched on, that same leaked password is far closer to useless to them, because they'd also need access to the second factor — typically a physical device they don't have.

The common forms it takes

• SMS codes — a one-time code sent by text. Widely used and better than nothing, but the weakest common option, since phone numbers can occasionally be hijacked through a tactic called SIM-swapping.
• Authenticator apps — generate a short-lived code on a smartphone, not tied to a phone number, making them meaningfully more secure than SMS.
• Push approval — a notification appears on a registered device asking you to approve or deny the login, which is quick and increasingly common in business systems like Microsoft 365.
• Hardware security keys — a small physical device plugged in or tapped to confirm a login; the strongest option, generally reserved for the highest-risk accounts.

The one real downside, and how to manage it

The honest drawback is a small amount of friction — an extra step, occasionally at an inconvenient moment, and a genuine problem if someone loses the device their authenticator app is on. Both are manageable: most systems allow backup codes or a secondary method to be registered in advance specifically for this situation, and it's worth setting that up before it's needed rather than after.

Where to prioritise it first

If MFA isn't switched on everywhere yet, the highest-value places to start are email (since it's often the key to resetting everything else), any remote access tools, your accounting or banking software, and your Microsoft 365 or Google Workspace admin account.

If you're not sure which of your systems currently have MFA properly enabled, or want help rolling it out without causing a headache for staff, our cyber security page covers how we can help, or get in touch.