*This information is adapted from the National Cybersecurity Alliance

What is Multi-Factor Authentication?

Multi-Factor Authentication (also known as MFA, two-factor authentication, and two-step verifcation), is an extra layer of security added to a login for a site. It requires that you prove your identity in more ways that just entering a username and password. There are many forms MFA takes, including but not limited to:
– entering a PIN (personal identification number) as well as a password
– answering a security question only you know the answer to
– entering a code sent to you via text, email, or phone call at the time of login
– biometric identifiers like fingerprint or face scan
– a separate app that requires you provide verification

Generally, after you enter your password, the site you are trying to log in to will instruct you on the second step to verifying. Some of these strategies are more common than others, but all are an extra layer of security before you log in, almost like a password for your password.

Where and why should you use Multi-Factor Authentication?

Ideally, MFA should be used for every account, as it adds a very strong extra layer of security. However, not every site has implemented its use. Others, though, you may already be using Multi-Factor Authentication! Here are some places to check if you can turn on MFA:
– banking
– email
– social media
– online stores
– school and work
These accounts hold important information, and therefore are more likely to be targeted by cybercriminals. If your accounts in these categories are able to have MFA, you should turn it on!

MFA might feel like a lot of extra work just to log in, and it’s true it does add an extra step to your logging in. However, just a couple seconds of extra work to get into your account will leave them so much more secure. It’s much harder for hackers to get into your account with MFA, as even if they acquire your password, they likely will not be able to get past the other form of verification. Because of this, you should at the very least have MFA for your most valuable accounts!

Recognizing Verification Requests

Like all cybersecurity strategies, there are still some vulnerabilities to MFA. The good news is that the most common vulnerability is also fairly easy to avoid. The most common way cybercriminals get around MFA is by repeatedly requesting access to an account, and the rightful user approving it. While it may sound silly, with so many requests on our devices at all times, it can be easy to just approve a login attempt just to get it out of the way, or under assumption you need to. This means that it is extra important to read all messages relating to logins and MFA carefully, and only approve logins that you recognize as you trying to log in to the account.

If you do ger a request that you don’t recognize, it’s best practice to change your password to something new, unique, and secure (see our post on Passwords). While you shouldn’t be reusing passwords, if you have reused that password make sure to change it for those other accounts as well. You can also get in contact with the service or platform, especially if you unintentionally approved the request and believe your data has been stolen or tampered with. Many sites also have an option to log you out of all devices, which you should do if your account has been compromised, after you’ve changed your password (and saved it in a password manager!). On the whole, as long as you are attentive to MFA requests, it adds a very valuable layer of security that can make your information on the web much safer.