Two-factor authentication, usually shortened to 2FA, is the extra step after a password - a code from an app, a text message, a tap to approve on your phone. Most people have used it without necessarily knowing what it's called or why it matters. It's one of the single most effective, low-effort things a business can do for its security.

Why a password alone isn't enough anymore

A password proves you know something. The problem is that "something you know" can be guessed, reused, phished, or simply leaked in a breach that had nothing to do with you - one weak or reused password on an unrelated website can end up being the same one protecting your email. 2FA adds a second requirement: something you have, usually your phone. An attacker with a stolen password still can't get in without it.

The main types, in plain terms

  • SMS codes - a text message with a one-time code. Better than nothing, but the weakest option, since phone numbers can sometimes be hijacked.
  • Authenticator apps - an app that generates a fresh code every 30 seconds. More secure than SMS, and doesn't rely on phone signal.
  • Push approval - a notification asking you to approve or deny a sign-in with one tap. Quick, and shows you exactly what's trying to log in.
  • Security keys - a physical device you plug in or tap. The strongest option, though usually reserved for higher-risk accounts.

For most small businesses, an authenticator app strikes the right balance between security and not making everyday logins a chore.

The most common objection, and why it doesn't hold up

The usual pushback is that it slows people down. In practice it adds a few seconds to logging in, and only when signing in somewhere genuinely new, not every single time. Set against what it prevents, that's a small cost for a large amount of protection, particularly on anything that touches email, finance, or customer data.

Where it matters most

Not every login needs the same level of protection, but a few are worth prioritising without exception: email (since it's usually the key to resetting everything else), any finance or banking access, and your Microsoft 365 or Google admin account. If 2FA is only switched on in one place, those are the places to start.

If you're not sure which of your accounts actually have 2FA switched on, book a complimentary IT call and we'll help you find the gaps.