MFA is a free and simple way to add an extra layer of security to your accounts. Instead of relying just on your password, MFA adds a second step to prove it’s really you.
Easy for You Is Easy for an Attacker, Too
James was relaxing at home when his phone suddenly erupted with notifications. The password for his personal email account had been changed, but he didn't remember changing anything. Soon after, his social media accounts followed, alerting him that those passwords had been changed, then his bank alerted him to suspicious purchases. Panicking, James tried logging into his email, but his password no longer worked. Someone had locked him out. Over the next several days, James spent hours recovering accounts, disputing charges, and changing passwords. What confused him most was that he had done everything he thought he was supposed to do: He used a strong password and never shared it with anyone.
But his password wasn't the problem; the problem was relying on just the password alone. What James didn't realize was that the urgent text message he received last week from what he thought was his email provider was actually from a cybercriminal, who had tricked him out of his password. Once the cybercriminal obtained the password to James' personal email, they had complete control of his email account. Not only were they able to access all of James' emails, but they could use his email account to reset the password on many of his other accounts.
James' sister, Ariel, received the very same text message, and just like her brother, she was tricked into clicking on the malicious link and entering her password. However, unlike James, Ariel used multi-factor authentication (MFA) to protect her email account. This meant that the attacker was missing a second factor needed to log in, separate from the password, and had a frustrating day of unsuccessful logins. Ariel blocked the attacker, secured her email, and had a much better day than James. Soon after, she helped her brother set up MFA so he could ruin an attacker's day, too.
What is Multi-Factor Authentication (MFA)?
MFA is a free and simple way to add an extra layer of security to your accounts. Instead of relying just on your password, MFA adds a second step (or factor) to prove it's really you. With MFA, logging in typically requires at least two of the following:
1. Something you know: your password
2. Something you have: a one-time code sent to your phone or generated by an app
3. Something you are: a fingerprint or facial recognition
Even if a cybercriminal steals your password, they still cannot access your account without that second factor. This is why enabling MFA is often considered the single most important step you can take to secure your accounts.
How to Use MFA the Right Way
MFA is simple to use and widely available. Most major services, including email, banking, social media, and shopping sites, offer it for free. Often you only have to log in once with MFA for each site; after that, the website remembers your browser, making authentication both stronger and simpler. Here's how to get started:
1. Turn on MFA for your important accounts: Start with your most critical accounts, including email, banking, and investments. If someone gets into your email, they can often reset access to your other accounts.
2. Use an authenticator app when possible: A texted code works, but a dedicated authenticator app that generates codes on your phone is more secure and reliable.
3. Combine MFA with strong passwords: Use a strong, unique password for each account in addition to MFA. If a site offers Passkeys, that's a very secure version of MFA.
4. Protect your mobile devices: Your phone is now central to MFA and may hold your password manager as well. Keep it secure with a screen lock and automatic updates.
Take Control of Your Security
Enabling MFA is one of the most powerful ways to protect yourself online. Don't wait until after your accounts are compromised like James'. Be like Ariel, and make sure it's the attacker who has a bad day.
Resources
How Cybercriminals Steal Your Passwords
The Power of a Password Manager
Questions about MFA on UMB systems? Contact the CITS Help Desk.
Every month, the SANS Institute publishes its OUCH! newsletter, a security awareness resource written for a general audience. CITS Security and Compliance shares it with the UMB community as part of our ongoing security awareness program. This month's edition covers Multi-Factor Authentication (MFA) and why it remains one of the single most effective steps anyone can take to protect an account.