StarLabs Glossary / Cybersecurity & Network Terms
MFA (Multi-Factor Authentication)
A second check at sign-in, so a stolen password alone is not enough.
Multi-factor authentication (MFA) is a sign-in method that asks for two or more different kinds of proof before granting access: something you know (a password), something you have (a phone or security key) or something you are (a fingerprint or face). If a password is stolen, the attacker still cannot log in without the second factor.
How it works
Passwords leak all the time. Staff reuse them across websites, type them into fake login pages, or have them exposed in someone else’s data breach. MFA adds a second step that a remote attacker usually cannot copy. You type your password as normal, then confirm the login with something only you hold.
Not all second factors are equally strong. Here is a rough ranking, from weakest to strongest:
| Method | How it works | Notes |
|---|---|---|
| SMS code | A one-time code is texted to your phone | Far better than nothing, but codes can be phished or intercepted |
| Authenticator app code | An app on your phone shows a code that changes every 30 seconds | Works offline and is not tied to your SIM card |
| Push approval with number matching | Your phone asks you to approve the login and type the number shown on screen | Number matching stops people tapping “approve” by reflex |
| Passkey or security key | A cryptographic key on your device or a USB/NFC key, unlocked by PIN or fingerprint | Resists phishing because it only works on the genuine website |
MFA is not perfect. Attackers try “MFA fatigue”, sending repeated approval requests in the hope that someone taps yes, and some phishing kits relay codes in real time. That is why phishing-resistant methods and staff training matter. Even so, switching on MFA blocks a very large share of everyday account takeovers, and it costs little: Microsoft 365 and Google Workspace both include it.
What it means for your business
Turn on MFA first for email, admin accounts, accounting software, banking, remote access and cloud storage. CSA’s Cyber Essentials standard expects MFA for administrative access, so it is also a step towards certification. Plan for lost phones too: keep backup codes somewhere safe and make sure someone can reset a staff member’s MFA quickly. StarLabs can roll out and enforce MFA across your Microsoft 365 or Google Workspace users and help staff set it up.
Common questions
Is MFA the same as two-factor authentication (2FA)?
Mostly, yes. 2FA means exactly two factors. MFA means two or more. In everyday use the terms are interchangeable.
What happens if a staff member loses their phone?
An administrator can reset their MFA and register a new device. Set up backup methods or recovery codes in advance so nobody is locked out for long.
Is SMS-based MFA still worth using?
Yes, it is much safer than a password alone. Where possible, move to an authenticator app or passkeys, which are harder to phish.
Is MFA switched on for every account?
Let StarLabs check and enforce it across your team.
Sources: CSA Cyber Essentials (2025) document
Reviewed by the StarLabs technical team · Last checked 18 October 2026
← Cybersecurity & Network Terms · ← All terms · Common questions
