Multi-factor authentication (MFA) requires a second verification step beyond your password. Even if your password is stolen, MFA prevents unauthorised access. Microsoft research found that MFA blocks 99.9% of automated account-compromise attacks.

Combine MFA with a dedicated password manager like NordPass to ensure every account has a unique, strong password alongside your second-factor protection.

{"type":"result","subtype":"success","is_error":false,"api_error_status":null,"duration_ms":25710,"duration_api_ms":27548,"ttft_ms":3243,"ttft_stream_ms":2751,"time_to_request_ms":474,"num_turns":1,"result":"

The Three Factors of Authentication Explained

\n

Before setting up MFA, it helps to understand what the \"factors\" actually are. Security professionals group authentication methods into three categories, and true multi-factor authentication combines at least two of them:

\n

\n
• Something you know — passwords, PINs, or answers to security questions. This is the weakest factor on its own because it can be guessed, phished, or leaked in a data breach.
\n
• Something you have — your smartphone, a hardware security key, or a smart card. An attacker would need physical possession of the device to bypass it.
\n
• Something you are — biometrics such as a fingerprint, face scan, or voice pattern. These are difficult to replicate and never need to be typed.
\n

\n

Combining two passwords does not count as MFA because both belong to the same category. The strength of multi-factor authentication comes from forcing an attacker to defeat completely different types of barriers at once.

\n\n

Choosing the Right MFA Method in 2026

\n

Not all second factors offer the same level of protection. According to data published by Microsoft, enabling any form of MFA blocks more than 99.9% of automated account-compromise attacks. However, the gap between the weakest and strongest options is wider than most people realize. Here is how the common methods rank:

\n

\n
• SMS text codes — better than nothing, but vulnerable to SIM-swapping and interception. Use only when no other option exists.
\n
• Authenticator apps (TOTP) — apps like Google Authenticator, Authy, and Microsoft Authenticator generate time-based codes offline. A solid middle ground for most users.
\n
• Push notifications — approve or deny a login with one tap. Convenient, but beware \"MFA fatigue\" attacks where criminals spam requests hoping you tap \"approve\" by mistake.
\n
• Hardware security keys (FIDO2) — physical keys such as YubiKey or Titan Key are phishing-resistant by design and represent the gold standard for high-value accounts.
\n
• Passkeys — the fastest-growing option in 2026, passkeys use device biometrics and public-key cryptography to eliminate passwords entirely.
\n

\n\n

Step-by-Step: Enabling MFA on Your Key Accounts

\n

The setup process is similar across most platforms. Follow these steps to secure your most important logins:

\n

\n
• Step 1: Open the security or privacy settings of your account (look for \"Two-Step Verification\" or \"Two-Factor Authentication\").
\n
• Step 2: Select your preferred method. Where possible, choose an authenticator app or hardware key over SMS.
\n
• Step 3: Scan the QR code with your authenticator app, or register your security key when prompted.
\n
• Step 4: Enter the verification code to confirm the connection works.
\n
• Step 5: Save your backup recovery codes in a secure location — ideally a password manager or printed copy stored offline.
\n

\n

Prioritize the accounts that would cause the most damage if compromised: your primary email, banking and financial services, password manager, and any account tied to your work or business.

\n\n

Don't Forget Your Backup and Recovery Plan

\n

The most common MFA disaster is losing access to your second factor — a lost phone, a wiped device, or a misplaced security key. A single point of failure can lock you out of your own accounts permanently. Protect yourself by building redundancy into your setup:

\n

\n
• Register at least two methods per account (for example, an authenticator app and a hardware key).
\n
• Store backup recovery codes somewhere you can access even if your phone is gone.
\n
• Consider buying a second hardware key and keeping it in a safe place as a spare.
\n
• Use an authenticator app that supports encrypted cloud backup so you can restore your codes on a new device.
\n

\n\n

Common MFA Mistakes to Avoid

\n

Even security-conscious users undermine their own protection with avoidable errors. Watch out for these pitfalls:

\n

\n
• Relying solely on SMS for high-value accounts when stronger options are available.
\n
• Approving push requests reflexively — never tap \"approve\" for a login you didn't initiate.
\n
• Storing backup codes in plain text on the same device that generates your codes.
\n
• Skipping MFA on \"minor\" accounts that share a password with important ones.
\n

\n

Multi-factor authentication is one of the highest-impact security upgrades you can make in minutes. Pair it with strong, unique passwords for every account, and you build a layered defense that stops the overwhelming majority of attacks before they ever reach your data.

","stop_reason":"end_turn","session_id":"ba553d28-7dfb-4e89-bea2-ee1e8d4b953c","total_cost_usd":0.120068,"usage":{"input_tokens":8492,"cache_creation_input_tokens":2327,"cache_read_input_tokens":15362,"output_tokens":1831,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":2327,"ephemeral_5m_input_tokens":0},"inference_geo":"not_available","iterations":[{"input_tokens":8492,"output_tokens":1831,"cache_read_input_tokens":15362,"cache_creation_input_tokens":2327,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":2327},"type":"message"}],"speed":"standard"},"modelUsage":{"claude-haiku-4-5-20251001":{"inputTokens":772,"outputTokens":22,"cacheReadInputTokens":0,"cacheCreationInputTokens":0,"webSearchRequests":0,"costUSD":0.000882,"contextWindow":200000,"maxOutputTokens":32000},"claude-opus-4-8[1m]":{"inputTokens":8492,"outputTokens":1831,"cacheReadInputTokens":15362,"cacheCreationInputTokens":2327,"webSearchRequests":0,"costUSD":0.119186,"contextWindow":1000000,"maxOutputTokens":64000}},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","uuid":"f3a68489-f975-4a95-ac69-ea174f5e265a"} {"type":"result","subtype":"success","is_error":true,"api_error_status":401,"duration_ms":625,"duration_api_ms":0,"num_turns":1,"result":"Invalid API key · Fix external API key","stop_reason":"stop_sequence","session_id":"f3517994-706b-455b-ab4e-7349ade3f2b6","total_cost_usd":0,"usage":{"input_tokens":0,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"output_tokens":0,"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":0,"ephemeral_5m_input_tokens":0},"inference_geo":"","iterations":[],"speed":"standard"},"modelUsage":{},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","uuid":"8e3a09e7-7b9b-4192-859f-713276e4e82e"}