Multi-factor authentication (MFA) is a sign-in method that requires two or more separate proofs of identity, typically something you know, such as a password, plus something you have, such as a phone app or security key. It prevents a stolen password alone from giving an attacker access.
After entering a password, the user confirms their identity through a second factor. Common options include a code generated by an authenticator app, a push approval on a phone, a hardware security key or a biometric check like a fingerprint. Text message codes are better than nothing but are generally considered weaker than app-based or hardware methods. Systems can also apply MFA only when something looks unusual, such as a new device or location.
Retailers and hospitality venues should apply MFA to email, cloud POS and back-office portals, payment and banking platforms, remote access and administrator accounts. Staff turnover and shared logins make passwords particularly vulnerable, so enrolling and removing users promptly is part of the discipline. MFA is one of the controls highlighted in the ASD's Essential Eight.
Pitfalls include leaving some accounts exempt, relying on shared mobile numbers, approving unexpected prompts out of habit and having no process for lost phones. Attackers sometimes bombard users with approval requests hoping they accept one, so staff need to know to report unexpected prompts. Provide backup methods and a clear recovery process so legitimate users are not locked out.
Enabled consistently, MFA blocks a large share of account takeover attempts at very low cost, which makes it one of the most effective security steps available. RetailCare can help set it up as part of its cyber security services.