What is multi-factor authentication?

There are three kinds of proof, or factors: something you know (a password or PIN), something you have (a phone or security key) and something you are (a fingerprint or face). MFA combines at least two of them. Two-factor authentication, or 2FA, is the most common form.

An example. A buyer at one of a wholesaler's trade customers reuses a password that leaked from another website. Attackers try it on the wholesaler's trade portal, where the account has credit terms and saved delivery addresses. With MFA switched on, the password alone gets them nowhere, and the buyer is never the wiser.

The main methods

• Authenticator apps. An app on your phone shows a code that changes every 30 seconds, or asks you to approve the sign-in.
• Passkeys. A newer, password-free way to sign in, unlocked by your fingerprint, face or device PIN. Passkeys only work on the website they were made for, so they resist phishing far better than codes.
• Security keys. A small physical key, plugged in or tapped, often used for admin and high-risk accounts.
• SMS codes. Better than a password alone, but the weakest option: codes can be intercepted, phished, or redirected by persuading a mobile network to move a number to a new SIM card.

Where it matters most

• Staff and admin sign-in. Anyone who can change your store, prices, payment pages or customer data. Magento and Adobe Commerce require two-factor authentication for the admin by default.
• Trade and customer accounts. Particularly accounts that can order on credit, see pricing or hold personal data. Here MFA needs to be easy, so many sites offer passkeys or ask for a second step only for new devices or risky actions.

How we do it

Account takeover usually starts with stolen passwords tried at scale against trade and customer accounts. We protect against it with multi-factor sign-in where it matters, rate limits on sign-in, alerts on unusual logins, sessions that expire and can't be reused and, for trade portals, sign-in restricted to the networks you expect. Sign-in is one of the first things a penetration test probes, and it features in the OWASP Top 10.