Turn on multifactor authentication (MFA) on every account that matters. It's the single change that does the most to keep people out of your email, your bank, and your company files.
MFA asks for a second proof of identity on top of your password. A password can be stolen, guessed, or phished. The second factor is something a thief usually can't produce: a code from your phone, a tap to approve a sign-in, or your fingerprint. So even when someone has your password, they're stuck at the next screen.
You'll see it called two-step verification, two-factor authentication, or a one-time password. Same idea behind all of them: prove it's really you before the account opens. The methods vary too. A confirmation email when you create an account, a security question at the bank, a texted code, a push notification, a phone call to verify. Most take a single tap or a short code.
Why one extra step stops most break-ins
For you, MFA is a tap or a six-digit code and you're in. For an attacker holding your password, it's a wall. When someone tries to sign in as you, MFA either asks them for a code they don't have or fires off a notification to your phone. That alert is also your warning: you know to change the password before any damage is done.
It even covers the case where an employee gets tricked into handing over a password. Without the second step, the attacker still can't get in. According to Microsoft, turning on MFA cuts the chance of an account being compromised by more than 99.2%, and up to 99.99% for fully secured accounts.
Where to turn it on, and how
Start with the accounts that would hurt the most if someone got in:
- Banking and financial apps
- Email and cloud storage
- Social media accounts
- Work logins that touch client data or company files
Setup is usually quick. Almost every major service has MFA built into its security settings. Pick the method that fits how you work and switch it on. For work logins, an authenticator app is the most secure option that's still easy to live with day to day.
MFA is free and takes a few minutes per account. Those minutes now save you from data loss and cleanup later.