If your business has turned on multi-factor authentication (MFA), well done. It is one of the most effective things you can do. But “we have MFA” can mean very different things, from a text message code that criminals have learned to intercept, to a security key that is very hard to fool. And many people discover the weak spot of MFA only when they lose their phone.
Here is a plain-English comparison, and what we recommend.
Why MFA is not all the same
MFA asks for something beyond your password: usually something you have (your phone or a key) or something you are (a fingerprint). A stolen password alone should then not be enough.
Criminals have adapted. Sophos’s 2026 State of Ransomware survey reports that where stolen credentials caused a ransomware attack, MFA was enabled in some capacity 97% of the time. The MFA was there; it just was not strong enough, or not everywhere. CISA puts it simply in its phishing-resistant MFA fact sheet: any form of MFA is better than none, but phishing-resistant MFA is the gold standard.
The options, from weakest to strongest
Text message and voice codes
A six-digit code arrives by text or phone call. Easy, and better than nothing, but CISA lists the ways it fails: phishing pages that ask for the code, attacks on the phone network itself, and “SIM swaps,” where a criminal talks your mobile provider into moving your number to their phone. Microsoft now describes text and voice as no longer secure methods and plans to retire its own text and voice codes for Microsoft 365 work accounts from February 1, 2027.
Authenticator app codes
An app on your phone generates a new six-digit code every 30 seconds. No text message to intercept, and no dependence on your mobile provider. This is the most widely supported option: banks, accounting software, domain registrars, social media and most business websites offer it. The weakness is that a convincing fake login page can still ask you to type the code, and pass it on in real time.
Push approvals
Your phone shows “Are you trying to sign in?” and you tap Approve. Convenient, but CISA warns about “push bombing”: criminals who already have your password send prompt after prompt until a tired person taps Approve. Prompts that make you type a number shown on the login screen (“number matching”) reduce that risk considerably.
Passkeys and security keys: phishing-resistant
A passkey or a physical security key uses cryptography tied to the real website. Nothing is typed, so there is nothing to phish, and a fake site simply gets no answer. This is where the industry is heading. Microsoft began making passkeys the default sign-in method for Microsoft 365 work accounts on September 1, 2026. We cover the pros and cons of passkeys separately; for now, use them where your key accounts offer them.
The part people forget: backups
The most common MFA disaster we see is not a hacker. It is a lost, broken or replaced phone, and suddenly nobody can get into the bank, the payroll site or the company’s social media. If the codes lived only on that phone, recovering each account can take days of calls and paperwork.
Plan for it before it happens:
- Use an authenticator app that backs up. Some apps keep codes only on one phone. Lose it, lose them all.
- Save each account’s backup codes. Most services, including Google, give you a set of one-time backup codes when you turn on 2-Step Verification. Print them or store them in a password manager, not on the phone itself.
- Register more than one method or device for critical accounts, such as a second phone, a security key, or a second administrator.
Google Authenticator and Google 2-Step Verification
Google Authenticator was long one of the apps that kept codes only on one phone. In April 2023, Google added syncing to your Google Account, which means your codes are backed up, but also that they depend on that Google account. If you use it, make sure sync is actually turned on, and keep your Google backup codes somewhere safe. Given our general advice to reduce dependence on Google for business, we prefer a separate app.
Why we recommend Authy
For code-based MFA on the many websites that support it, we recommend Twilio’s Authy app. According to Authy’s own feature page, as of September 2026:
- Encrypted cloud backup. Your codes are encrypted with a backup password you choose before they are stored. Authy says it never receives that password and cannot recover it if you forget it, so write it down somewhere safe.
- Multiple devices. The same codes can be available on more than one phone or tablet, on iOS and Android. Twilio’s help pages suggest turning the multi-device setting on while you add a new device, then turning it off again so nobody else can add one.
Two things to know. Twilio discontinued the Authy desktop apps for Windows, Mac and Linux in March 2024, so Authy is now phone and tablet only. And in July 2024 Twilio reported that criminals had matched phone numbers to Authy accounts through an unsecured interface, which it has since closed; it said accounts themselves were not compromised, but warned users to watch for phishing texts. Keep the app updated, and treat unexpected “Authy” messages with suspicion.
For Microsoft 365 work accounts, follow Microsoft’s direction instead: passkeys, Windows Hello or the Microsoft Authenticator app, set up and managed centrally.
What to do now
- List the accounts that can move money or change settings. Confirm each has MFA, and not just text codes.
- Move those accounts to passkeys or security keys where offered, and to an authenticator app everywhere else.
- Check that every authenticator app in the office has a working backup, and that backup codes are stored off the phone.
- Make sure no critical account depends on one person’s phone.
- If you use Microsoft 365, plan for the passkey changes before February 2027.
How FTI helps
We set up and manage Microsoft 365 sign-in for our clients, including passkeys and MFA rules, and help staff set up Authy and store backup codes properly. We also keep an eye on sign-in alerts as part of our managed IT services, so unusual login attempts reach an engineer. Stronger MFA reduces risk; it does not remove it, which is why we pair it with the other layers described in our security services. For how criminals capture codes as you type them, see social media and keyloggers.
