Multi-Factor Authentication: Choosing the Strongest Second Step

What you'll be able to do

Choose the strongest second factor an account offers and respond safely to an unexpected sign-in prompt or loss of phone service.

• Place the common sign-in methods into three tiers of strength.
• Turn on the strongest option each of your important accounts offers.
• Recognise MFA fatigue and SIM swapping, and know what to do about each.

Two kinds of proof are better than one

There are three kinds of evidence you can use to prove who you are:

• Something you know: a password or PIN.
• Something you have: your phone, a security key.
• Something you are: your fingerprint or face.

Multi-factor authentication (MFA), also called two-step verification, asks for two or more different kinds. A criminal who has stolen or guessed your password still needs the second factor, which they usually do not have.

That makes a measurable difference. A 2023 Microsoft Research study of real Microsoft cloud accounts found that MFA reduced the risk of compromise by about 99.2%, and by about 98.6% even for accounts whose passwords had already leaked. CISA's guidance is clear that any MFA is better than no MFA.

The three tiers

Not all second steps are equally strong. Following CISA's guidance, this course groups them into three tiers. Use the strongest tier each account offers.

Tier 1: Phishing-resistant

• Passkeys and other FIDO credentials (Lesson 4.6).
• Hardware security keys: small physical devices you plug in or tap against your phone.

These are tied to the genuine website, so a look-alike page has nothing it can collect and reuse. CISA describes FIDO-based authentication as the only widely available phishing-resistant option.

Tier 2: Strong, but not phishing-resistant

• An authenticator app with number matching: when you sign in, the app asks you to enter a number shown on the sign-in screen before approving.
• Authenticator-generated one-time codes: an app on your phone shows a short code that changes frequently, which you type in after your password.

Both stop a criminal who has only your password. Both can still be defeated if you are tricked: CISA describes people typing their password and authenticator code into a fake page, which the criminal uses immediately. Which of the two suits you depends on the account and your device; this course does not rank one above the other.

Tier 3: Text message (SMS) or voice codes

A code sent by text or phone call. This is weaker: the code can be phished in the same way, and it goes to whoever controls your phone number, which creates the SIM-swap risk described below. But it is still preferable to a password alone when nothing stronger is offered. Turn it on, and move up a tier when the account allows.

Start with the accounts that unlock others: your email, your password manager, your bank and your phone carrier account.

Never approve a prompt you did not start

Criminals who already have your password can trigger sign-in prompts to your phone again and again, hoping you will tap "Approve" by mistake, out of confusion or just to make them stop. This is called MFA fatigue or push bombing. NIST SP 800-63B-4 lists authentication fatigue as a threat and expects each sign-in approval to be a deliberate act.

The rule is simple: never approve a prompt you did not start. If one appears:

1. Deny it, or simply do not approve it.
2. Treat it as a sign that someone probably has your password.
3. Change that password from your own device, by going to the site yourself, and check the account's recent activity.
4. If it is a work or study account, report it to your IT team.

Number matching helps, because a blind tap is not enough: you would need the number from a sign-in screen you are actually looking at. And the same logic applies to codes: no genuine company will call or message you to ask for one.

SIM swapping and your phone number

In a SIM swap, a criminal persuades or tricks your mobile carrier into moving your phone number to a SIM card they control. From that moment, your calls and text-message codes go to them. One warning sign is your phone suddenly losing service for no obvious reason.

To protect yourself:

• Set an account PIN or passcode with your carrier, and turn on MFA for your carrier account, as CISA's 2025 mobile guidance advises.
• Move important accounts off SMS to a Tier 1 or Tier 2 method where you can.
• Never give your password or PIN to a caller; contact your carrier or bank through their official number yourself.
• Avoid posting publicly about money or cryptocurrency, which makes you a more attractive target.

CISA's guidance for people at especially high risk goes further and advises not using SMS as a second factor at all.

Activity: turn on MFA

Work privately through your most important accounts: email, password manager, bank and phone carrier.

1. Open each account's security settings and see which sign-in methods it offers.
2. Turn on the highest tier available. If only SMS is offered, turn it on anyway.
3. Set up a backup method too, so losing your phone does not lock you out. If the service gives you recovery codes, store them in your password manager or keep a printed copy somewhere safe (Lesson 4.7 goes further).
4. Sign out and back in once to check it works.
5. Set a carrier account PIN if you have not already.

To record completion, note only the account type and the tier you reached, for example "email: Tier 1, bank: Tier 3, upgrade when offered".

Real-World Example

In February 2022, the FBI's Internet Crime Complaint Center (IC3) warned that criminals were increasingly using SIM swaps to steal money. In 2021 alone it received 1,611 SIM-swap complaints with reported losses of more than $68 million, compared with about $12 million in total across 2018 to 2020. Once criminals controlled a victim's number, they could receive the text-message codes protecting bank and cryptocurrency accounts.

The lesson is not that MFA failed. It is that the weakest tier was the target. Victims whose accounts used a Tier 1 or Tier 2 method, and whose carrier accounts were protected by a PIN, gave criminals much less to work with.

From the Book to 2026

What the book teaches. In Chapter 2's story of the journalist Mat Honan (Lesson 1.3), the book explains that two-factor authentication, a password plus a single-use code sent to his phone, would have reduced his vulnerability, because it is far harder for an attacker to defeat. Its key takeaway: two-factor authentication cuts vulnerability, and it is within your control.

Why it made sense. That remains true. Honan himself wrote afterwards that with two-step verification on his Google account, it is possible none of it would have happened, though it would not have prevented the Apple phone-support reset.

What has changed. Security guidance has evolved since the original text. There is now a range of second factors, and codes sent by text message are the weakest of them because of phishing and SIM swapping. Attackers phish codes in real time and bombard people with approval prompts. Current guidance now recommends using the strongest method each account offers, with phishing-resistant options such as passkeys and security keys at the top.

What to do now. Turn on MFA everywhere it matters, choose the highest tier available, protect your phone number with a carrier PIN, and never approve a prompt you did not start.

What Would You Do?

At home one evening, your phone suddenly shows "No service", although everyone else in the house has signal. A few minutes later your laptop shows an email: "Your password was changed."

What do you do? Decide, then check the note after the Knowledge Check.

Knowledge Check

Key Takeaways

• MFA asks for two different kinds of proof, so a stolen password alone is not enough.
• Tier 1 (passkeys, security keys) resists phishing; Tier 2 (app with number matching, app codes) is strong; Tier 3 (SMS, voice) is weaker but better than a password alone.
• Use the strongest tier each account offers, starting with email, password manager, bank and carrier.
• Never approve a sign-in prompt you did not start.
• Protect your number with a carrier PIN; sudden loss of service can signal a SIM swap.

Further Study

Optional and external; not needed to complete the lesson.

• Tom Scott — Why You Should Turn On Two Factor Authentication

Sources

• CISA — Implementing Phishing-Resistant MFA (fact sheet, October 2022)
• CISA — Implementing Number Matching in MFA Applications (fact sheet, October 2022)
• CISA — Mobile Communications Best Practice Guidance (version 2.0, November 2025)
• CISA — Multifactor Authentication
• NIST — SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management
• FBI IC3 — Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public (February 2022)
• Microsoft Research — How effective is multifactor authentication at deterring cyberattacks? (May 2023)
• PBS NewsHour — Tips From Mat Honan After the Hack That Brought Down His Cloud (August 2012)
• seclists.org — Repost of Mat Honan's Wired article (August 2012)
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 2