Multi factor authentication, MFA, means proving who you are with two different things rather than one: your password, plus something else, a code from an app, a prompt on your phone, or a physical key. It matters because a password alone is no longer good enough proof of anything. An estimated 47% of UK businesses have adopted MFA, according to industry research from SecurEnvoy, which means more than half haven’t, despite Microsoft’s own 2025 Digital Defense Report stating that phishing-resistant MFA blocks over 99% of identity-based attacks, even when a password has already been stolen.
That gap between how effective it is and how many businesses actually use it is the whole story of this post.
Why a password alone stopped being enough
A password is something you know, and the trouble with things you know is that they can be learned by someone else: guessed, reused from a breached website, or typed straight into a fake Microsoft 365 login page of the kind covered in what a phishing attack actually looks like, an earlier post on this blog. Once that happens, a password on its own puts up no further resistance. Whoever has it can log in exactly as if they were you.
MFA adds a second category entirely. Even if the password is compromised, the attacker also needs the code generated on your phone, the push notification you’d have to approve, or the physical key plugged into your laptop. That second factor is what turns a stolen password from “game over” into “inconvenient but contained.”
| MFA type | How it works | Strength |
|---|---|---|
| Text message code | A one time code sent by SMS | Weakest, vulnerable to SIM swap fraud and interception |
| Authenticator app | A code or approval prompt in an app on your phone | Strong, good default for most businesses |
| Hardware security key or passkey | A physical key or device-stored credential | Strongest, resistant to phishing because it checks the website is genuine before it works |
Not all MFA is equally strong
This is worth being honest about, because “we’ve turned MFA on” can mean quite different levels of actual protection depending on which type, and it’s exactly the warning in the NCSC’s own guidance on this: not every method of MFA offers the same level of protection, and some have already been defeated in real attacks against organisations that assumed MFA alone made them safe.
Text message codes are better than nothing, but they’re the weakest option. Attackers can sometimes intercept them, or persuade a mobile network, usually through a convincing enough phone call or a bribed insider, to move your number onto a SIM card they control, a fraud known as SIM swapping. Once that’s done, the text message codes meant to protect your account arrive on the attacker’s phone instead of yours, and you often don’t find out until you notice your own phone has lost signal.
An authenticator app, the kind that generates a rotating code or sends an approval prompt, is meaningfully stronger and is a sensible default for most small businesses. It isn’t tied to your phone number, so it isn’t exposed to SIM swap fraud, and it’s free and quick to set up on Microsoft 365, Google Workspace and most other business systems.
A hardware security key or a passkey stored on your device is the strongest option, and it’s what Microsoft’s 99% figure specifically refers to: phishing-resistant MFA. The key checks that it’s talking to the genuine website before it releases anything, which means even a perfect, pixel accurate fake login page can’t trick it.
Where to turn it on first
Email comes first, because it’s usually the account that can reset every other account’s password. Remote access and VPN logins come next, then accounting, banking and payroll, then cloud storage and file sharing.
For a business the size of most reading this, roughly 10 to 75 people, that whole first tier is usually a single afternoon’s work. Microsoft 365 and Google Workspace both let an administrator require MFA for every user from one central setting. NCSC’s guidance on MFA for corporate online services takes the same view: enforce the strongest practical option centrally rather than leaving it to individual choice.
The one way around it that’s worth knowing about
MFA built around an approval prompt has one specific weakness: the prompt can be sent by someone who already has your password. This is called MFA fatigue or prompt bombing — sending enough approval requests that someone eventually taps approve just to stop the notifications. That’s the same reporting habit covered in how to train staff to spot a phishing email, an earlier post on this blog: a business that makes reporting easy finds out in minutes rather than discovering the damage later. Hardware keys and passkeys aren’t vulnerable to this trick at all.
The honest downside, and why it’s worth it anyway
MFA adds a step to logging in. The most common real complaint is what happens when someone loses their phone and can’t complete the second step — the fix is a recovery process agreed before it’s needed, not improvised in a panic.
Frequently asked questions
Is MFA the same as two factor authentication, 2FA? Yes, in practical terms — 2FA is MFA using exactly two factors.
Will MFA stop every attack? No. It stops the overwhelming majority of password-based attacks, but it isn’t a defence against every kind of compromise.
Can MFA be bypassed? Rarely, mainly through prompt bombing — one more reason to prefer authenticator apps and hardware keys over text messages.
What’s the quickest win with nothing in place? An authenticator app on email alone, today — under half an hour for a small team.
Does MFA cost anything? Not usually for authenticator apps; hardware keys carry a modest one-off cost, worth reserving for finance or IT admin accounts.
127 Solutions runs a free 20 minute IT audit across Cheshire, Wirral, Chester and Liverpool, checking exactly which systems have MFA on, which type, and where the gaps are. Book yours here.