MFA

Also called Multi-factor authentication, Two-factor authentication, 2FA

Requiring a second proof of identity beyond a password. The single highest-value security step available.

What it means

Multi-factor authentication requires something in addition to a password — a code from an app, a hardware key, or a biometric — before granting access.

Passkeys are a newer approach that replaces the password entirely with a cryptographic key held on your device.

Why it matters

Passwords get reused, guessed and stolen in bulk from other services. MFA means a stolen password on its own is not enough.

It is cheap, it is usually included in software you already pay for, and it prevents the great majority of account takeovers.

What it looks like in practice

Turn it on for email first. Email is the reset mechanism for everything else, so it is the account that protects all the others.

Then banking, accounting software, domain registrar, and anything holding customer data.

Prefer an authenticator app or a hardware key over SMS. SMS codes can be intercepted by SIM swapping, though SMS is still far better than nothing.

What to watch out for

Recovery codes stored in the same place as the passwords.

Shared accounts, which make MFA awkward and accountability impossible. Use individual accounts with appropriate permissions.

MFA fatigue attacks, where repeated prompts are sent hoping someone approves one to make it stop. Number matching helps.

Where to get proper advice

The NCSC's guidance on multi-factor authentication for online services. Most software vendors document their own setup clearly.