A stolen password should not be enough to open the door to your business. Yet passwords are still guessed, reused, leaked and tricked out of people through convincing-looking emails. So, what is multi factor authentication? It is a simple extra security check that asks you to prove it is really you before giving access to an account.
For a small business or charity, multi factor authentication, often shortened to MFA, is one of the most useful protections you can put in place. It takes a few extra seconds when someone signs in, but it can prevent a far more disruptive problem: an outsider reading emails, changing bank details, accessing customer information or pretending to be a member of staff.
What is multi factor authentication?
Multi factor authentication means using two or more separate ways to verify your identity. Your password is the first factor. The second factor might be a code from an authenticator app on your phone, a prompt you approve in that app, a fingerprint or a physical security key.
The key idea is that a criminal needs more than your password. Even if they have obtained it, they should still be stopped because they do not have your phone, fingerprint or security key.
You may also hear the term two factor authentication, or 2FA. This is a type of MFA that uses exactly two checks, usually a password plus one other method. In everyday conversation, people often use MFA and 2FA to mean much the same thing.
Why passwords alone are no longer enough
A strong, unique password still matters. It is your first line of defence. The problem is that passwords can be exposed without anyone breaking into your computer.
A staff member may reuse a password from another service that later suffers a data breach. Someone may enter their details into a fake Microsoft 365 sign-in page after receiving a realistic phishing email. Or a password may be shared informally and then forgotten about when a volunteer or employee leaves.
Without MFA, that password can be all an attacker needs. With MFA turned on, a sign-in attempt from an unfamiliar device triggers another check. The attacker may know the password, but they cannot complete the sign-in.
This matters especially for email. Email accounts often contain invoices, personal information, reset links for other services and conversations that reveal how your organisation works. Once inside an email account, a criminal can watch messages, impersonate a director or request a payment at exactly the wrong moment.
The common types of MFA, in plain English
Not all second checks offer the same level of protection. The best option depends on the systems you use, how your team works and how much support they need.
Authenticator app
An authenticator app generates a short code that changes regularly, or displays a sign-in prompt for you to approve. Common examples include Microsoft Authenticator and Google Authenticator.
For most small organisations, this is a sensible starting point. It is quick, does not rely on a mobile signal and is generally safer than receiving a code by text message. Each person should use their own app on their own phone, rather than sharing codes or setting up one device for the whole team.
Push notification
With a push notification, a message appears on your phone asking whether you are trying to sign in. You tap approve or deny. It is convenient, but it needs care.
Never approve a prompt you did not expect. Criminals sometimes try repeated prompts in the hope that a tired or busy person taps approve just to make them stop. If that happens, deny the request and change your password. Where available, use number matching, which asks you to enter a number shown on the sign-in screen before approval.
Text message code
A code sent by SMS is better than having no MFA at all, and it can be useful where a person cannot use an app. However, it is not usually the first choice. Text messages can be delayed, phones can be lost, and there are more ways for criminals to interfere with a mobile number than with an authenticator app.
Treat SMS as a practical fallback, not your preferred method for your most important accounts.
Security key
A security key is a small physical device, often plugged into a USB port or tapped against a compatible phone. It provides very strong protection and is particularly useful for people with access to finance, sensitive records or administrator accounts.
It does bring a practical responsibility: keys can be misplaced. Keep a spare key securely stored and make sure more than one trusted person knows the recovery process.
Where should a business start?
Start with the accounts that could cause the greatest damage if they were taken over. For most organisations, that means email, Microsoft 365 or Google Workspace, accounting software, banking, payroll, customer databases and any account used to manage staff access.
Do not forget administrator accounts. These accounts can create users, reset passwords and change security settings. They need particularly careful protection, ideally with an authenticator app or security key and a separate, unique password.
If you run a charity, this is just as relevant. Donor details, grant applications, financial records and beneficiary information can all be sensitive. MFA is not only about avoiding inconvenience; it helps you meet the trust people place in your organisation.
A sensible way to introduce MFA to your team
Turning on MFA without a little planning can create avoidable frustration. The goal is to make the secure choice the easy choice.
First, make a short list of the accounts your organisation relies on and identify who owns each one. Check that personal accounts are not being used for business logins where a shared or managed account would be more appropriate.
Next, choose your standard method. An authenticator app is usually the clearest option for staff and regular volunteers. Give people time to set it up while they have access to help, rather than forcing everyone to do it during a busy morning.
Then, record recovery details safely. Many services provide recovery codes when MFA is enabled. Store these in an approved, access-controlled password manager or another secure location. Do not leave them in an open spreadsheet, a desk drawer or an email inbox.
Finally, explain the one rule everyone must remember: no unexpected prompt should ever be approved. A five-minute explanation can prevent a costly mistake.
What happens if someone loses their phone?
This is the question that often puts people off. A lost phone is inconvenient, but it is manageable if you prepare for it.
Make sure the phone itself has a screen lock. Where your chosen service allows it, register a backup method, such as a second authenticator device, recovery codes or a security key. Keep a clear process for who can help a member of staff regain access and how their identity will be checked first.
Avoid making one person the only route back into every account. If the owner is on holiday, unwell or has left the organisation, you still need a safe way to manage access. This is one area where a little documentation saves a lot of stress later.
MFA is powerful, but it is not magic
MFA dramatically reduces the risk from stolen passwords, but it does not make every scam disappear. Someone can still be persuaded to share a code, approve a fraudulent prompt or send money after receiving an impersonation email.
That is why MFA works best alongside a few sensible habits: unique passwords stored in a password manager, software updates, limited access for each role and a clear process for checking unusual payment requests. For example, a request to change supplier bank details should be confirmed using a known phone number, not the number included in the email.
There is also a balance to strike. If security is so awkward that staff look for workarounds, it is not doing its job properly. Choose a method people can use confidently, provide straightforward guidance and review access when somebody joins, changes role or leaves.
A small step that protects real work
MFA can sound like another piece of IT jargon, but the everyday benefit is straightforward: a password leak does not automatically become a business breach. Set it up first for the accounts you would least like to lose, make sure your team knows what an unexpected prompt looks like, and keep recovery options organised. That modest extra check can protect a great deal of time, money and trust.