The arithmetic of multi-factor authentication

Most credential-based compromises share one trait — the account had no second factor. The numbers are not subtle. Microsoft reports that MFA blocks over 99 per cent of automated attacks on accounts. Not 50 per cent. Not 80 per cent. Ninety-nine.

Multi-factor authentication — MFA — means proving your identity with something beyond your password. A code from an app on your phone. A tap on a hardware key. A fingerprint. The password is the first factor — something you know. The second factor is something you have or something you are. The second factor is what stops an attacker who has stolen, guessed, or phished your password.

The cost is zero for most implementations. Authenticator apps are free. The time investment is ten minutes per service, done once. The ongoing inconvenience is an extra five seconds at login — a code from your phone, a tap on a key. Set against the cost of a compromised email account, a hijacked domain, or a fraudulent bank transfer, the arithmetic is not close.

MFA is not a premium security control reserved for large enterprises. It is a baseline. It is the single highest-leverage control in the five controls that matter. It should be enabled on every service, for every user, without exception.

SMS, authenticator apps, and hardware keys

Three common second factors, in ascending order of strength.

SMS codes — a text message with a six-digit number sent to your mobile phone. Better than nothing. Meaningfully better than nothing. But vulnerable to SIM swapping — an attacker calls your mobile provider, impersonates you using personal details scraped from social media or leaked databases, and convinces the provider to port your number to their SIM card. They then receive your codes. SIM swapping is not theoretical. It is a documented, active attack method used against businesses and individuals. It is particularly effective against high-value targets — directors, finance staff, anyone whose phone number is publicly available.

SMS codes are also vulnerable to interception via SS7 — the signalling protocol that routes text messages between mobile networks. SS7 attacks are less common and more technically demanding than SIM swapping, but they are within reach of organised criminal groups.

Authenticator apps — Microsoft Authenticator, Google Authenticator, Authy — generate time-based one-time passwords (TOTP) locally on your phone. The app and the service share a secret key during setup. The app generates a new six-digit code every thirty seconds based on that key and the current time. The codes never leave the device. They cannot be intercepted remotely. They do not depend on your mobile network. If your phone has no signal, the codes still work. This is the baseline you should deploy for all staff.

A note on TOTP apps: Google Authenticator now offers cloud backup of your TOTP secrets. This is convenient for device migration but means your codes are stored in your Google account. If your Google account is compromised, your TOTP secrets are compromised. For maximum security, disable cloud backup in the app and store the original QR codes or setup keys securely — printed, in a safe.

Hardware keys — YubiKey, SoloKeys, Google Titan — are physical USB or NFC devices. They implement the FIDO2/WebAuthn standard. They are phishing-resistant because they verify the domain cryptographically. When you authenticate, the key checks that the domain requesting the credential matches the domain where the credential was registered. An attacker who builds a convincing fake login page — say, m1crosoft-login.com instead of login.microsoftonline.com — cannot harvest a hardware key response. The key checks the domain, sees the mismatch, and refuses. No human judgement required. The protocol prevents the attack.

Hardware keys cost between twenty and fifty pounds each. For a five-person business, that is a one-time investment of a hundred to two hundred and fifty pounds to protect your most sensitive accounts with the strongest available second factor.

Start with authenticator apps for all staff. Move to hardware keys for anyone with administrative access to any system and anyone who handles financial transactions or approves payments.

Microsoft 365

Open the Admin Centre. Navigate to Users → Active Users → Multi-factor authentication.

The fastest path for a small business is Security Defaults — a free setting available on every M365 plan. It enables MFA for every user via the Microsoft Authenticator app. It blocks legacy authentication protocols — POP3, IMAP, SMTP AUTH — which cannot support MFA and are a common bypass. It requires MFA for all administrative actions. It requires all users to register for MFA within 14 days.

Security Defaults is the minimum. It is adequate for many small businesses and costs nothing beyond the base M365 subscription.

Business Premium subscribers have access to Conditional Access, which offers fine-grained control. Conditional Access policies can require MFA only from untrusted locations, block sign-ins from countries you do not operate in, require compliant devices for access to sensitive data, and enforce session timeouts. If you have Business Premium, use Conditional Access instead of Security Defaults — the two cannot run simultaneously.

Whichever path you choose, require the Authenticator app with number matching. Number matching displays a two-digit number on the sign-in screen and asks the user to enter it in the Authenticator app. This prevents MFA fatigue attacks — the technique where an attacker sends repeated push notifications until the user taps "Approve" out of frustration, confusion, or the desire to make the notifications stop.

Do not permit SMS as a second factor in M365 if you can avoid it. Do not permit the simple approve/deny push notification. Number matching is the minimum for push-based MFA. The Microsoft 365 hardening tutorial covers M365 security in more depth.

Google Workspace

Open the Admin console. Navigate to Security → Authentication → 2-Step Verification. Set enforcement to On. Set the enrolment period — 14 days is reasonable. This gives staff two weeks to set up their authenticator app before enforcement begins.

Allow authenticator apps and security keys. Disable SMS as a fallback if your threat model permits it. For most small businesses, removing SMS as an option is the right call — it forces users to set up the authenticator app, which is more secure and equally convenient once configured.

Google Workspace also supports context-aware access — similar to M365 Conditional Access. You can restrict access based on IP address, device posture, and geographic location. These settings are under Security → Context-aware access in the Admin console.

Banking

Most UK business banks require MFA for online banking already. This is a regulatory requirement under PSD2 — the Payment Services Directive — which mandates strong customer authentication for electronic payments.

Verify that your bank uses its own app for the second factor, not SMS. Register a backup method — typically an alternative phone number or a hardware token provided by the bank.

Ensure the finance team's personal mobile numbers are registered individually. Do not rely on a shared SIM or a desk phone that may be unattended. Each person who authorises payments needs their own second factor on their own device. A shared authenticator defeats the purpose — it removes individual accountability and creates a single point of failure.

Check whether your bank supports hardware security keys for business accounts. Barclays, HSBC, and NatWest all offer hardware token options for business banking. The bank-issued hardware token is an additional layer beyond the app — use both where available.

Domain registrars

This one matters more than people expect. Whoever controls your domain controls your email, your website, and your TLS certificates. The domain is the root of trust for your digital presence.

If an attacker compromises your registrar account, they redirect your MX records — the DNS entries that tell the internet where to deliver your email. Every email sent to your organisation goes to the attacker. Every password reset email goes to the attacker. From there, they reset passwords on every other service and take control of the lot.

They can also modify your A records to point your website at a server they control, issue TLS certificates for your domain using DNS validation, and transfer the domain to a registrar in a jurisdiction where recovery is difficult.

Enable MFA on Namecheap, GoDaddy, Cloudflare, or whichever registrar you use. The setting is usually under Account → Security or Profile → Two-Step Verification. Use an authenticator app, not SMS. If your registrar supports hardware keys, use one.

Lock the domain with registrar lock (also called client transfer lock) to prevent unauthorised transfers. Most registrars enable this by default, but verify it.

Hosting panels

cPanel — navigate to Home → Security → Two-Factor Authentication. Enable it and scan the QR code with your authenticator app. Every account on the cPanel instance — root, reseller, and individual accounts — should have MFA enabled independently.

Plesk — navigate to My Profile → Security. Enable two-factor authentication. Plesk supports both TOTP apps and hardware keys.

These panels control your web infrastructure directly. An attacker with cPanel access can modify your site's source code, inject malicious JavaScript that captures visitor credentials or credit card numbers, read your databases including customer records, create email accounts for use in further attacks, install persistent backdoors that survive password changes, and modify server configuration. Protect them accordingly.

Social media

Facebook Business — Settings → Security and Login → Two-Factor Authentication. Select an authenticator app. Facebook also supports hardware keys.

LinkedIn — Settings → Sign in & Security → Two-step verification. Enable and configure an authenticator app.

X/Twitter — Settings → Security → Two-factor authentication. Note that X removed SMS-based MFA from free accounts in early 2023. Authenticator apps and hardware keys are the available options.

These settings move frequently as platforms redesign their interfaces. If you cannot find the setting, search for "two-factor" in the platform's settings search bar. Enable MFA on the business account and on every personal account that has admin access to the business page. A compromised personal account with admin rights to your company page is a compromised company page.

Password managers

Bitwarden — Settings → Two-step Login. Enable an authenticator app as the second factor. Bitwarden also supports hardware keys and email-based verification.

1Password — uses a Secret Key plus master password by default. The Secret Key is a 128-bit value generated during account creation. It is combined with your master password to derive the encryption key. This is effectively two-factor — an attacker needs both the master password and the Secret Key. Store the Secret Key securely — print it and keep it in a safe, or store it in a separate physical location from your device.

LastPass — Account Settings → Multifactor Options. Enable an authenticator app. LastPass also supports YubiKey and other hardware tokens.

Yes — enable MFA on the service that holds all your other passwords. If an attacker compromises your password manager without MFA, they gain the credentials for every service stored in it. The password manager is the crown jewel. Protect it accordingly.

Accounting and line-of-business software

Xero — Settings → Users → select your user → Enable two-step authentication. Xero supports authenticator apps. Enable it for every user with access, particularly anyone who can approve payments or modify bank feed settings.

QuickBooks Online — Account and Settings → Security → enable two-step verification. QuickBooks supports authenticator apps and SMS. Choose the authenticator app.

Sage — the MFA setting depends on the product variant. Sage Business Cloud: Settings → My Profile → Security → Two-step verification. Enable an authenticator app.

Any software that holds financial data, customer data, or employee data should have MFA enabled. If the software does not offer MFA, that is a reason to evaluate alternatives. In 2026, the absence of MFA support is a red flag about a vendor's security posture.

The rollout sequence

Deploy MFA in this order, based on what an attacker gains from compromising each service. The principle is simple — protect the services that control other services first, then work outward.

Roll it out to administrators and finance staff first. Then to all staff. Give people a week to set up their authenticator app. Send clear instructions with screenshots — not a policy document, but a step-by-step walkthrough with pictures. Hold a ten-minute walkthrough session for anyone who wants help. Make it easy and people will do it. Make it confusing and they will put it off.

Common objections and how to answer them

"It slows me down." By five seconds per login. Most services remember trusted devices for 30 days. The actual day-to-day friction is minimal — you authenticate with MFA once a month per device, not every time you check email.

"What if I lose my phone?" Backup codes exist for exactly this reason. An administrator can reset your MFA registration. The procedure takes fifteen minutes, not fifteen days. Losing your phone without MFA means nothing changes. Losing your phone with MFA means a brief, documented recovery process. The inconvenience of the recovery is real but bounded. The inconvenience of a compromised account is neither.

"Our staff are not technical enough." Authenticator apps require scanning a QR code once and reading a six-digit number thereafter. If your staff can use a banking app, they can use an authenticator app. The setup walkthrough takes ten minutes with screenshots. The ongoing use requires no technical knowledge.

"We have never had a breach, so we do not need it." This is survivorship bias. The businesses that have been breached also believed it would not happen to them. MFA is not insurance against bad luck. It is a lock on the door. The absence of a burglary does not mean the lock is unnecessary.

Backup codes

Every service that offers MFA also offers backup codes — a list of one-time-use codes that work when you cannot access your second factor. Your phone is lost, stolen, broken, or simply out of battery.

Print them. Store them in a safe or a sealed envelope in a locked drawer. Not in a file on the computer — if the computer is compromised, those codes are compromised too. Not in the password manager — if you are locked out of the password manager, the backup codes for the password manager are inside the thing you are locked out of.

Each code works once. After you use it, cross it off. When you have used half of them, generate a new set.

Some services — Microsoft 365, Google Workspace — also allow an administrator to reset a user's MFA registration. This is the recovery path when backup codes are also unavailable. Ensure at least two administrators have MFA configured independently so one can always rescue the other.

When someone loses their phone

This will happen. Plan for it now, not when it happens on a Friday evening before a bank holiday.

The procedure is simple, provided it has been documented and communicated in advance.

This is why the backup codes exist. This is why an administrator must be reachable outside business hours. Build this procedure into your incident response plan so the person on the other end of the phone knows what to do without improvising.

The operational picture

MFA is the single highest-leverage control in the five controls that matter. Enable authenticator-app MFA on every service — email, domain registrar, banking, password manager, cloud platforms, hosting, social media — starting with the accounts that control the most. Print backup codes and store them in a safe. Test the phone-loss recovery procedure before you need it. Give staff clear instructions with screenshots, a week to comply, and a ten-minute walkthrough if they want it. Ten minutes per service, done once, and the vast majority of credential-based attacks against your organisation will fail.