Category hub: Credentials, identity and exposure

In one sentence: Multi-factor authentication means you need something more than a password to sign in, such as a code from an app, so a stolen password alone is not enough.

What is multi-factor authentication?

The NCSC says 2-step verification (2SV), also called two-factor authentication (2FA) or multi-factor authentication (MFA), helps keep criminals out of your accounts even if they know your passwords. It calls turning it on one of the most effective ways to protect online accounts.

A “factor” is a type of proof: something you know (a password), something you have (a phone or key), or something you are (a fingerprint). MFA asks for two or more.

How it works

1. You enter your username and password.
2. The service asks for a second proof. This might be a code in an authenticator app, a text message, an approval on your phone, or a security key.
3. Only when both are right are you let in.
4. Some services ask for the second step every time. Others only ask when something looks unusual, such as a new device.

It does not make you immune. The NCSC warns that attackers have developed methods against weaker types: tricking a user into typing a code into a fake site, or flooding a user with approval requests until they tap “yes”.

Who it affects and how badly

MFA matters wherever staff sign in over the internet.

• Sole trader to 10 staff: it is the cheapest protection for your email and accounting software. Without it, one leaked password can mean a hijacked mailbox.
• 10 to 50 and 50 to 250 staff (all sectors): missing MFA on a few accounts, often admin or older accounts, is a common gap.
• 250 plus and regulated firms (councils, fintech, healthcare): weak MFA on privileged accounts can lead to data loss and reportable breaches. The NCSC recommends moving to phishing-resistant types.

Real examples

In a blog post the NCSC says some recent high-profile breaches of corporate data, including one that affected Ticketmaster, Santander and other Snowflake customers, would probably not have occurred with MFA in place: NCSC blog.

How to detect it

• In Microsoft 365, check your identity provider’s report of users who have not registered for MFA. In Microsoft Entra this is under authentication methods.
• Review sign-in logs for sign-ins that succeeded with only a password.
• Look for repeated unexpected approval prompts, which staff may report as “weird notifications”.
• Check that service and admin accounts are not exceptions.

How to fix or prevent it

1. Turn on MFA for every account, starting with email, admins and finance.
2. Prefer stronger methods. The NCSC’s order starts with FIDO2 credentials, then app-based approval and code methods. SMS is the most common but not the most secure.
3. Use a Conditional Access policy to require MFA and block legacy sign-in methods.
4. Use number matching on authenticator prompts. CISA describes it as a mitigation for approval fatigue, though not phishing-resistant.
5. Give staff backup codes and a safe recovery process, so lockouts do not push them to weaker options.
6. Tell staff never to share a code, even if asked.

Related terms

• phishing-resistant-mfa
• mfa-fatigue-attack
• passkeys
• password-manager
• conditional-access
• brute-force-attack

Also read: credential-stuffing.

Frequently asked questions

What is multi-factor authentication?
It means you need something more than a password to sign in, such as a code from an app, so a stolen password alone is not enough.

Which MFA method is best?
The NCSC’s order starts with FIDO2 credentials, then app-based approval and code methods. SMS is the most common but not the most secure.

Where should I turn MFA on first?
Start with email, admins and finance accounts, then extend to every account.

How Wolfcore helps

Breachy checks whether your staff email addresses and passwords are already in known breaches and gives you the exact steps to close each exposure. See Breachy breach exposure monitoring.

Service page: Breachy breach exposure monitoring.