· 1 min read
Most account takeovers begin with a password the attacker should not have: reused, guessed, or typed into a fake sign-in page. A second sign-in step means that the password alone is no longer enough.
What it looks like
After you type your password, you approve the sign-in in an authenticator app on your phone, or enter a short code. Someone in another country with your password cannot do that.
Where to switch it on first
- Email accounts, especially finance and managers, because email resets every other password.
- Microsoft 365 or Google Workspace admin accounts.
- Banking and payment portals.
- Cloud consoles such as Azure and AWS.
- Remote access and VPN.
Make it easy for staff
- Do the set-up with people, in a short session.
- Give them a way back if they lose their phone, handled by one named person.
- Explain why, in one sentence: it stops strangers using a stolen password.
It is not a complete defence. Attackers also trick people into approving a prompt, so tell staff never to approve one they did not start.
General information. It is not legal or professional advice for your situation.