How MFA works
Three quick steps every time a user signs in from a new device or risky context.
- Identify. The user enters a username and password. This is the first factor — something they know.
- Prompt. The system prompts for a second factor: a code from an authenticator app, a push notification, or a tap on a hardware key.
- Verify. If the second factor is valid, the user is authenticated. If it is missing or wrong, access is denied, even if the password was correct.
Why MFA matters
Most breaches still begin with a stolen or guessed password, and MFA remains the single cheapest control that defeats the bulk of those attempts outright. It's also effectively mandatory now — cyber insurance carriers routinely decline or surcharge applicants without it, and frameworks from SOC 2 to HIPAA expect it, so the real question for a small business is not whether but how well it's deployed.
The four common types of MFA, weakest to strongest
- SMS text codes. A one-time code by text message. Better than a password alone, but vulnerable to SIM-swapping and to phishing pages that relay the code in real time. Avoid for administrators and finance.
- Authenticator apps (TOTP). Rotating codes from an app like Microsoft Authenticator. No phone number to hijack and works offline, though a convincing fake login page can still capture a code as it's typed.
- Push notifications. Approve the sign-in with a tap. Convenient, but attackers exploit it by spamming prompts until someone taps approve — number matching closes most of that gap.
- Hardware keys and passkeys. FIDO2 keys like a YubiKey, or passkeys bound to a device. The credential is cryptographically tied to the real site, so a look-alike phishing page gets nothing usable.
Common MFA mistakes
- Coverage with exceptions. MFA on email but not the VPN, or exemptions for executives who found it annoying, leaves exactly the doors attackers check first. Enforce it everywhere for everyone, the exceptions list is the target list.
- Soft enrollment and reset paths. If a caller can sweet-talk the help desk into resetting MFA, the control is only as strong as that phone call. Require identity verification for resets and treat new-device enrollment as a security event worth logging.
- Set-and-forget after rollout. Attackers adapted to MFA with prompt-bombing and real-time phishing proxies. Turn on number matching, review sign-in logs for odd patterns, and move admins toward phishing-resistant methods over time.