PROTECT · MULTI-FACTOR AUTHENTICATION
Multi-Factor Authentication — What Happens If a Password Is Stolen?
Passwords are useful, but they are not infallible. MFA gives an important account another barrier when a password falls into the wrong hands.
What is multi-factor authentication?
Multi-factor authentication, usually shortened to MFA, asks for more than one form of evidence before allowing access to an account.
A password may be one factor. The second could be an authenticator app, security key, passkey or another approved method supported by the service.
The important idea is simple: knowing the password should not automatically mean getting into the account.
Why does MFA matter?
Passwords can be exposed through phishing, reuse, data breaches or other mistakes. If an attacker has the correct password and nothing else stands in the way, the account may be theirs to use.
MFA adds another check. It does not make an account invulnerable, but it can significantly reduce the value of a stolen password.
Start with the accounts that matter most
Email is often a priority because it can be used to reset passwords for other services. Finance systems, cloud administration, remote access and accounts containing important business or customer information also deserve attention.
Do not assume MFA is active simply because the provider offers it. Check the actual account configuration.
Make the stronger option the normal option
Where a service provides several authentication choices, use the strongest practical method supported by your organisation and provider. Also consider recovery: if somebody loses a device, the business needs a controlled way to restore legitimate access without creating an easy bypass for attackers.
BOI ACTION
Check MFA on your most important account.
Open the security settings for your main business email or another critical service. Confirm whether MFA is enabled, which method is being used and whether all important users are covered.
If it is not enabled, identify who owns the decision and what is needed to switch it on.
A useful question for the business
If somebody obtained this password today, what would stop them signing in?
Don’t assume. Check.
“We have MFA” is not the same as confirming that MFA protects the accounts that matter. Check the coverage and the configuration.
NOT SURE WHERE TO START?
Take the 15-Minute Business Security Check
Ten straightforward questions will help you identify three priorities for sensible action.
Useful guidance
Final publication QA will verify current UK-first MFA and account-security guidance and supporting authoritative sources.
Continue exploring
Protecting access helps prevent an incident. Backups help when prevention is not enough.
Explore the Cyber Security Guides →
Found something that may be outdated or incorrect? Let us know.
Better Decisions. Stronger Organisations.
Understand what matters. Take sensible action. Check whether it worked.
