How MFA works (and how attackers get around it)

A password is a key, and keys can be copied. It leaks in a data breach, gets guessed, or gets typed into a fake login page. Once someone else has it, they can walk straight in. The account looks the same. Only the person holding the key has changed.

What the second lock checks

Multi-factor authentication adds a second lock. One factor is something you know, like the password. The other is something you have, like your phone. Even when an attacker already has the password, the login stops and asks for that second factor. They don't have your phone, so they're stuck outside.

The password is not made secret again. It just stops being enough on its own. That's why turning MFA on is one of the most effective things you can do for an account.

How a prompt becomes the way in

Attackers have adapted. One trick is to spam you with approval requests, hoping you'll tap approve just to make the noise stop. That's called MFA fatigue. The prompt is a real one. The person who started the login isn't you.

Never approve a request you didn't start. A prompt while you're away from the desk, or one you weren't expecting, is the attack. Deny it. Tapping through to clear the notification is the yes they were waiting for.

Number matching

Where you can, use number matching. The login screen shows a number, and you type that number into the app. A random tap won't let anyone in, because approve on its own is no longer the whole answer. If you didn't start the login, you don't have a number to enter.

What won't work on a fake site

Stronger still are phishing-resistant methods, like passkeys and security keys. They simply won't work on a fake website. A copied password works in any form that looks right. A passkey or a security key checks that it is talking to the real site, and it stops when it isn't.

If a service offers one, it's the better second factor for the accounts that matter: email, where password resets arrive, and the login that controls the domain. That domain account is the one in How DNS works. Point it somewhere else and the website and the mail follow, even when staff type the address perfectly.

A practical checklist

• Turn MFA on everywhere you can, starting with email, banking, and anything that controls the domain. A password on its own should not be enough for any of those.
• Never approve a prompt you didn't just start, and tell staff the same. An approval is a yes to a login, not a way to dismiss a notification.
• Turn on number matching where the app offers it, so a tap without the number on the screen does nothing.
• Use a passkey or a security key where the service supports it, especially for email and the domain. They won't finish a sign-in on a fake page.

If the prompts start and you didn't cause them, deny them. Don't keep tapping until the noise goes away.

If you'd rather hand this on

The second lock is one setting in a set: email, the registrar, banking, the administrator accounts. Looking after that set, including who can change what, is what managed IT is for. Nexcentric does that for Australian businesses, with a local team and the scope in writing.

If you want a second look at which accounts are still a password on their own, book a free review. We'll say what we find, including when nothing needs changing.

The free tools cover the cost of managed IT, where the business sits on the Essential Eight, and a short cyber awareness course for staff. The Weekly Byte is the note we send when there is one practical thing worth passing on.