What MFA is

Multi-factor authentication, usually shortened to MFA, asks for more than a password when you sign in. The extra proof might be an authenticator app, a security key, a device prompt or a code. This reduces the chance that a stolen password alone gives someone access, but it does not make every sign-in request safe.

Choose and set it up safely

  • Turn on MFA through the provider's official account or security page, not a link in an unexpected message.
  • Prefer an authenticator app or security key where the provider and your recovery plan support it.
  • Protect the phone, app or key with its own screen lock or physical security.
  • Add only recovery methods that you control and keep their details current.
  • Store recovery codes separately from the password and everyday device.
  • Test the normal sign-in and approved recovery route before declaring setup complete.
  • For a work account, follow the organisation's approved method rather than adding an unrecorded personal workaround.
  • Review registered methods periodically and remove old phones or unfamiliar devices.

The strongest available option is not useful if losing one device permanently locks out the owner. Security and recovery need to be planned together.

Understand prompts and codes

Approve a prompt only when you have just started that sign-in and the details make sense. Repeated or unexpected prompts can mean someone knows the password and is trying to persuade you to approve access. A caller who knows your name, employer or account provider still must not be given a sign-in, authentication or recovery code.

MFA protects the sign-in step. It does not make a phishing website trustworthy, remove the need for unique passwords or protect an already unlocked session from every threat.

What not to do

Do not approve an unexpected prompt to make it disappear. Do not read a code to a caller or store recovery codes beside the password. Avoid registering a shared telephone number without clear ownership. Never disable MFA because repeated malicious prompts are inconvenient; change the password and investigate the cause.

When to stop and ask for help

Use the provider's official recovery route if you lose the approved method, replace a phone without transferring access or receive prompts you did not initiate. For a work account, tell the responsible administrator promptly. If an unexpected prompt was approved, treat it as a possible account compromise rather than simply declining the next one.

Prepare for support

State the account provider, whether it is personal or work-owned, which approved method you normally use and whether you can still sign in on any trusted device. Record unexpected prompt times and approximate locations shown. Never include a live code, password or recovery code in the request.