Two-factor authentication
A second check when you sign in, such as a code from an app or a tap on your phone, so a stolen password alone isn't enough to get into your account.
Two-factor authentication, or 2FA, adds a second step when you sign in. First comes your password, which is something you know. Then you confirm with something you have, like your phone or a security key. It’s also called two-step verification or multi-factor authentication (MFA).
Common methods, from strongest to weakest:
- Passkeys and security keys: very hard to beat with phishing. They only work on the real site.
- Authenticator apps: a code or an approval prompt on your phone.
- Text message codes: better than nothing. But SIM-swap scams can steal them.
Why it matters to a small business
Stolen and reused passwords are behind many account takeovers. With 2FA turned on, a criminal who has your password still can’t get in. The US Cybersecurity and Infrastructure Security Agency (CISA) backs it in its guidance on multifactor authentication.
Start with the accounts that open the door to everything else. That means email, banking, your domain registrar and website admin. Add your Google Business Profile, social media and your password manager.
Save the backup codes each service gives you. Then a lost phone won’t lock you out.
Example
An insurance agent’s email password leaks in another company’s data breach. A criminal tries to sign in. But the account needs approval in an authenticator app. The agent sees a prompt they didn’t expect. They deny it and change the password.
Learn more
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.