What Is Multi-Factor Authentication, and Why Does It Actually Matter?

Short answer: Multi-factor authentication (MFA) asks for a second proof of identity, like a code from a phone app, on top of your password. It matters because passwords get phished, breached, and reused, and MFA stops a stolen password from being enough on its own.

Both the phishing and ransomware posts landed on the same recommendation: turn on multi-factor authentication. This post is the one that actually explains what that means and why it works — not just "turn it on because it's good for you."

What's actually happening

A password is one point of failure. If it's guessed, reused, or handed over on a fake login page, that's the whole lock — whoever has it gets in, full stop. Multi-factor authentication (MFA) means logging in requires a second proof of identity on top of the password, from a different category entirely:

• Something you know — the password itself.
• Something you have — a phone with an authenticator app, a text message code, or a physical security key.
• Something you are — a fingerprint or face scan.

MFA requires at least two of those categories together. The point isn't that a second password-like thing is harder to guess — it's that an attacker who obtains your password through phishing, a data breach, or reused-password credential stuffing (trying a password leaked from one unrelated site against all your other accounts) still doesn't have your phone. One stolen category isn't enough on its own anymore.

The common second factors, plain English

• Authenticator app codes (Google Authenticator, Microsoft Authenticator, Authy, and similar) — a free app generates a new 6-digit code every 30 seconds. Free, doesn't need cell signal, and generally the best balance of security and convenience for a small business.
• Text message (SMS) codes — a code sent to your phone by text. Better than no MFA at all, but weaker than an app: it depends on your phone number staying under your control, and phone numbers can occasionally be hijacked (a "SIM swap").
• Security keys and passkeys — a physical USB/NFC key, or a passkey stored on your device. The strongest option available, and specifically resistant to the kind of fake-login-page attack described in the phishing post — but not every service supports it yet.

A local business scenario

(A composite, illustrative pattern — not one specific business's story.)

An employee at a small retail shop uses the same password for their personal streaming account and their work email, because it's one less thing to remember. Months later, that unrelated streaming service gets breached, and the leaked password — email address plus password, in plain sight in a dump attackers trade online — gets tried automatically against thousands of other websites, including the shop's email provider. The employee never clicked a phishing link, never did anything wrong at the shop itself; the leak happened somewhere else entirely.

Without MFA, that reused password alone is enough — the attacker is in the work email account within minutes, reading invoices and customer messages. With MFA turned on, the stolen password gets the attacker exactly as far as the login screen: it prompts for the code from the employee's phone, which the attacker doesn't have, and the login simply fails. The breach that happened somewhere else never becomes a breach here.

The honest limits

MFA isn't invincible. A sophisticated, targeted phishing attack can sometimes relay a one-time code in real time, right as a victim types it into a fake login page — the same "sometimes" nuance covered in the phishing post. That's a real, if less common, attack pattern, and it's part of why a security key or passkey (which isn't just a code an attacker can relay) is the strongest option where it's supported.

But that targeted, real-time attack is rare compared to what actually hits most small businesses: automated tools trying leaked or guessed passwords at scale, with no human on the other end crafting anything in real time. Against that — the overwhelmingly common case — even basic SMS-based MFA blocks it outright. Turning on MFA anywhere it's offered is still the single highest-leverage security habit available, even knowing it isn't a perfect, unbeatable lock.

Best practices

1. Turn on MFA everywhere it's offered, starting with email. Email is usually the password-reset path into everything else — a compromised email account can cascade into every other account tied to it.
2. Prefer an authenticator app or security key over SMS when a service offers the choice — meaningfully harder to intercept, for the same basic effort to set up.
3. MFA is a backstop, not a reason to get lazy about password reuse. It stops a stolen password from being enough on its own — it doesn't fix the habit of reusing passwords in the first place, which is what put you in this position to begin with.
4. Turn on MFA for employees too, not just your own logins. One unprotected employee account is still a way into the business — the retail-shop scenario above didn't involve the owner's own password at all.
5. A "remember this device" option trades convenience for slightly reduced protection on that device — reasonable on a personal device only you use, not on a shared or public computer.

Helpful, free resources

• Have I Been Pwned — check whether your email address (or a specific password) has already shown up in a known data breach, free. A good first step before deciding where MFA matters most.
• 2FA Directory — a free, independent directory of which services actually support MFA and how to turn it on for each one.

A note on what this is and isn't: this post is general security education, not a personalized risk assessment of your specific business or systems. If you want a free, automated starting point for your own site, we offer a Security Health Check — free for any business, no obligation.