What is multi-factor authentication (MFA)?

Multi-factor authentication (MFA) requires a second proof of identity on top of your password — a code from an app, a tap on your phone, a hardware key — so that a stolen password alone is not enough to get in. It is the single highest-value security control a small business can switch on, and it is one of the ASD Essential Eight:

• Why it matters so much — most small-business break-ins start with a reused or phished password, and MFA defeats that attack even when the password is already in the wrong hands.
• Turn it on first for the accounts that would hurt most to lose — email, banking, your domain registrar, and any admin login to your website.
• Prefer an authenticator app or hardware key over SMS codes, which can be intercepted.
• Backed by official guidance — the ACSC’s small business guidance lists MFA among its top recommendations.

If you do one security thing this week, switch on MFA for your email and your domain registrar — those two protect everything else.