You’ve probably heard the term two-factor authentication, or 2FA, or MFA, more times than you can count over the past few years. And if you haven’t got around to setting it up yet, you’re not alone. But it really is one of the most impactful things you can do to protect your business accounts. Here’s what it actually is and why it matters so much.
The problem with passwords alone
A password is a single line of defence. If someone gets hold of it, through a data breach, a phishing attack, or simply because it was easy to guess, they have everything they need to get into your account.
Data breaches happen constantly, and many people reuse passwords across multiple services. If a site you signed up to years ago gets breached, and you used that same password for your business email, that’s a direct route in for an attacker.
What two-factor authentication does
Two-factor authentication adds a second requirement on top of your password. Even if someone has your password, they also need that second factor to get in, and that’s something they almost certainly don’t have.
The most common forms of the second factor are a code sent to your phone via text, a code generated by an authenticator app, or a push notification you approve on your phone. Each of them achieves the same thing: proving it’s actually you trying to log in, not just someone with your password.
Which accounts should have it enabled?
Short answer: all of them. But if you’re prioritising, start here.
- Your email account: this is the master key to almost everything else, since password resets go to your inbox
- Cloud storage: OneDrive, Google Drive, Dropbox
- Financial tools: accounting software, online banking, payment platforms
- Business applications: CRM systems, project management tools, anything client-related
- Domain and hosting accounts: losing control of these can be extremely disruptive
Authenticator apps vs text messages
Text message codes (SMS) are better than nothing, but they’re not the strongest option. There are known attacks that can intercept SMS codes. An authenticator app, Microsoft Authenticator, Google Authenticator, or Authy, generates codes locally on your phone and is harder to compromise.
For most small businesses, either option is a significant improvement over no second factor at all. If you’re choosing from scratch, go with an authenticator app.
It takes five minutes to set up
The main barrier to enabling 2FA is usually inertia. It feels like it might be complicated or add friction to every login. In practice, most services only ask for the second factor when you log in from a new device or location, it doesn’t slow down your daily work.
If you need a hand getting 2FA set up across your business accounts, that’s exactly the kind of thing we can help with.
