Multi-Factor Authentication, Explained
Why MFA stops the attacks that passwords cannot, how to set it up, which methods are genuinely safer, and what to do when a prompt arrives that you did not ask for.
In short: multi-factor authentication stops the attacks a password alone cannot, because a stolen password is no longer enough on its own. Not every method is equally safe. An approval prompt you did not ask for should be denied and reported rather than tapped away, and MFA belongs first on email and anything that can move money.
Passwords fail for a reason that has nothing to do with how clever yours is. They get reused across sites, and when any one of those sites is breached, the password is sold. Multi-factor authentication breaks that chain: knowing the password is no longer enough, because the attacker also has to hold something you have.
Not All Multi-Factor Authentication Is Equal
People often assume MFA is a single thing. It is a category, and the options inside it differ enormously in how much protection they actually provide.
Text message codes are the weakest common option, and they are still far better than nothing. The weakness is that phone numbers can be moved to an attacker’s device through the carrier, an attack called SIM swapping. Use SMS if it is the only thing available, but do not choose it when something better is offered.
Authenticator apps generate a rotating six digit code on your device without needing a signal. This is the sensible default for most people and most systems. The code never travels over the phone network, so it cannot be intercepted the way a text can.
Push approvals send a prompt to your phone that you approve or deny. Convenient, and safe as long as you read them, which is precisely where they fail. Prefer the version that shows a number on screen that you must type into the phone, because it makes approving by reflex impossible.
Hardware security keys are small devices you tap or plug in. They are the strongest option available because the key verifies the website’s real identity before it releases anything, which means they defeat even a perfect copy of a login page. For administrators, finance staff and anyone whose account would be worth the most to an attacker, these are worth the modest cost.
Setting It Up
Install an authenticator app on your phone before you begin, then open the security settings of the account you are protecting and choose to add a new sign in method. You will be shown a QR code. Scan it with the app, then type the six digit code back into the website to prove the pairing worked.
The step everyone skips is the one that matters most. When the site offers you recovery codes, save them somewhere you can reach without your phone. Print them, or store them in the password manager we set up for you. People lose access to accounts far more often through a lost or replaced phone than through an attack, and recovery codes are the difference between a two minute fix and a long conversation with a vendor.
If you get a new phone, move your authenticator before you wipe the old one. Most apps have an export or transfer function that takes a minute and saves an afternoon.
The Prompt You Did Not Ask For
If a code or an approval request arrives and you were not signing in, that is not a glitch. It means somebody has your password and is standing at the door.
Deny it. Do not approve it to make it stop, which is what attackers are counting on when they send prompts repeatedly late at night. Then change that password immediately, and tell us, because we need to check whether the same credentials opened anything else.
Nobody from UniVirtual Solutions will ever call you and ask you to read out a code or approve a prompt. Neither will your bank, or Microsoft, or anyone else. A request to share a code is, without exception, an attack in progress. Turn multi-factor authentication on for email first, then everything that touches money.
Where It Belongs First
If you are rolling this out and cannot do everything at once, the order that reduces risk fastest is straightforward.
Start with email, because email is the master key: whoever controls it can reset the password on almost everything else. Then remote access, including VPN and any remote desktop. Then finance and banking systems. Then your line of business application, the one that would stop the company if it stopped. Administrator accounts should have been first and should use hardware keys.
Do it for everyone, not just for leadership. Attackers do not aim at the most senior person, they aim at the least protected one and work sideways from there.
MFA Questions We Get Asked
The practical objections, answered honestly.
No, if it is configured properly. Trusted devices in known locations can be remembered for a set period, so most people are prompted occasionally rather than constantly. Badly configured MFA prompts everyone all day and gets switched off within a month, which is the real risk.
You call us and we verify who you are before resetting the enrollment, which is exactly the check that protects you. If your recovery codes were saved when the account was set up, you may be able to get back in yourself in under a minute.
Almost certainly. MFA on email and on remote access is now a standard question on cyber insurance applications, and answering it inaccurately can put a future claim at risk. If you are unsure what your policy actually asks for, we will read the application questions with you before you sign.
Some forms can. Codes can be phished in real time by a fake login page that relays them, and push prompts can be approved by a tired user. That is why number matching and hardware keys exist. No control is absolute, but MFA removes the overwhelming majority of automated attacks that would otherwise succeed.
Poorly, which is the honest answer. Shared logins break the link between an action and a person and they make MFA awkward. Where a shared account genuinely cannot be avoided, a password manager with a shared vault and a single enrolled second factor is the usual compromise, and we will set that up with you.
What Is Multi-Factor Authentication, In One Minute
Multi-factor authentication means a sign-in needs two different kinds of proof: something you know, like a password, and something you have, like your phone or a security key. A stolen password on its own no longer gets anyone in.
That is the whole idea. Everything else on this page is about choosing the second proof well, and about the moment a prompt arrives that you did not expect.
You will also see it called two-factor authentication, 2FA or two-step verification. For everyday purposes they mean the same thing.
MFA Gaps We Find When We Audit Accounts
Old sign-in methods left switched on. If older email protocols or app passwords are still allowed, an attacker can sign in around MFA entirely. Switch those off when you enforce MFA.
Only one device registered. If that one phone is lost, the person is locked out. Add a second method, such as a security key or a second authenticator, while you still have access.
Admin accounts treated like everyone else’s. The accounts that can change settings for the whole company deserve the strongest method available, which is usually a hardware key.
Assuming it stays done. New starters, new apps and new phones all need enrolling, so check coverage every time someone joins or leaves, because that is when the gaps appear.
When An MFA Problem Needs Us
Call the security line straight away if you approved a prompt you did not start, if you typed a code into a page that looked slightly wrong, or if prompts keep arriving late at night. Call 678-374-4352 and press option 1.
Use the help desk for everything else: a new phone that needs enrolling, a lost device, an authenticator showing the wrong account, or a sign-in that keeps looping back to the code screen.
Not Sure Where MFA Is Switched On Today?
We will audit every account your business depends on and show you exactly which ones are protected and which are not. Multi-factor authentication stops the overwhelming majority of account takeovers.
CISA explains the same reasoning in its guidance on turning MFA on.