What is multi-factor authentication and do I need it?

The details

Not all MFA is equal. Security keys and passkeys resist phishing best, authenticator apps are a strong everyday choice, and SMS codes are better than nothing but can be intercepted through SIM swapping or phishing pages.

Turn MFA on for your email account first, because email is used to reset every other password.

What to do

• Enable MFA on email first, then banking, social media and cloud storage.
• Prefer passkeys, security keys or an authenticator app over SMS.
• Save the backup codes somewhere safe and offline.

Terms explained

Multi-factor authentication

Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.

Passkey

A passkey is a phishing-resistant sign-in credential based on public-key cryptography, stored on a device or in a password manager and unlocked with a biometric or device PIN.

Phishing

Phishing is a fraudulent message, usually email, that impersonates a trusted sender to trick people into revealing credentials, paying money or running malware.

SIM swapping

SIM swapping is fraud where a criminal convinces or bribes a mobile carrier to move a victim’s phone number to a SIM the criminal controls, to receive their calls and SMS codes.

Sources

• CISA: More than a Password (MFA)
• NIST SP 800-63B Digital Identity Guidelines