Multi-factor authentication (MFA) adds another check to a sign-in, so a password alone is less likely to be enough for someone trying to access your account.
Which options are available?
Depending on the service, options may include security keys, passkeys, authenticator apps or one-time codes. Some options offer stronger phishing resistance than others. Prefer the strongest practical method supported by the service and appropriate for your situation.
Good practices
- Enable MFA first on email, financial, domain registrar, hosting and administrator accounts.
- Never approve an unexpected sign-in prompt or share a one-time code with another person.
- Store recovery codes somewhere secure and separate from the account they recover.
- Keep recovery email addresses and phone numbers up to date.
- Review account sessions and remove access you no longer recognise.
For business accounts
Prioritise privileged accounts and make MFA part of staff onboarding and offboarding. Establish a safe recovery process so security controls cannot be bypassed casually under pressure.
More help
If you are planning a broader security improvement programme, explore cyber security consulting or use the contact page.