What Does MFA Actually Do, and Why Does Everyone Keep Telling You to Turn It On?

Short answer: MFA means a stolen password alone isn’t enough to get into your accounts, the attacker also needs a code from your phone or another device, which stops the vast majority of break-ins before they start.

Multi-factor authentication comes up constantly in cybersecurity advice, but it’s worth understanding what it’s actually doing rather than just switching it on because someone said to.

How it actually works

After entering your password, you’re asked to confirm it’s really you, usually via a code sent to your phone or an approval notification in an app. Both the password and the device are needed to get in.

Why passwords alone aren’t enough anymore

Passwords get exposed in data breaches far more often than most people realise, often without the account holder ever finding out. MFA is what stops that exposed password from actually being usable by someone else.

Where to turn it on first

Start with business email and any system holding customer or financial data, these are the accounts attackers target first, and the ones where a breach causes the most damage.

It adds a small amount of friction to logging in, in exchange for closing off one of the most common ways businesses get compromised.