MFA stands for multi-factor authentication. It means you need two things to log in: your password and a second check, like a code or a prompt on your phone.

If someone steals your password, they still cannot get in without your phone.

Why it matters

Passwords get stolen all the time: through fake emails, through data breaches at other websites, and when people reuse the same password in many places. You cannot always stop a password from leaking. MFA stops a leaked password from being used.

What to do

1. Turn on MFA for your email first. Your email is used to reset every other password you have, so protect it first.

2. Use an authenticator app instead of text messages when you can. An app like Microsoft Authenticator is harder for criminals to intercept than a code sent by text.

3. Never approve a login you did not start. If your phone asks “Are you trying to sign in?” and you are not, tap No and tell your IT team. It means someone has your password.

4. Use a password manager. It creates and remembers a different strong password for every account, so you only have to remember one.

The main thing to remember

A password alone is not enough. Turn on MFA, starting with your email.