Multi-factor authentication

Multi-factor authentication (MFA) requires a second form of proof beyond a password, something you have (a phone, a security key) or something you are (a fingerprint), before granting access.

Why it matters so much

Even a leaked or guessed password becomes far less useful to an attacker if they still need a second factor they don't have. MFA is one of the highest-impact single controls available, and it blocks the large majority of automated account takeover attempts.

Not all MFA is equal

• SMS codes: better than nothing, but vulnerable to SIM-swapping, where an attacker convinces a mobile provider to move a phone number to a device they control.
• Authenticator apps (generating time-based codes): meaningfully stronger than SMS.
• Hardware security keys or passkeys: the strongest widely available option, resistant to phishing because they're tied to the specific legitimate website.

Enabling any form of MFA is a large improvement over none. Enabling the strongest form available for your most important accounts, email, banking, password manager, is worth the extra few minutes of setup.