· Security · 3 min read
What 2FA Is, and Why Your Email Needs It
Two-factor authentication means a stolen password alone can't open an account. Which kinds hold up best, and why your firm's email is the first place it belongs.
Two-factor authentication, or 2FA, means a stolen password isn’t enough to get into your account. Signing in takes the password plus a second proof, usually a code or a prompt on your phone, and someone who steals or guesses the password still can’t get in without it.
You’ll also see it called multi-factor authentication, or MFA. Microsoft uses that name, and for practical purposes it’s the same idea.
The kinds of second factor
They aren’t equally strong. Text-message codes are the weakest of the common options, and passkeys and security keys are the strongest:
- A code sent by text message. Far better than nothing, but an attacker can sometimes take over your phone number by talking your carrier into moving it to a new SIM card.
- A code from an authenticator app, such as Microsoft Authenticator or Google Authenticator. The code is generated on your phone and never travels over the phone network.
- A prompt in an authenticator app that asks you to approve the sign-in. Microsoft Authenticator makes you type a number shown on the sign-in screen, which makes it much harder to approve a prompt you didn’t start by accident.
- A passkey or a physical security key. These are built to resist phishing, because they only work on the real website they were set up for.
If a service offers an app as well as text messages, take the app.
Why email comes first
If you only turn 2FA on in one place, make it your email. Most of your other accounts, the domain registrar included, will reset a forgotten password by sending a link to your inbox. Whoever controls the inbox can reset their way into most of the rest.
A firm inbox is also where the money conversations happen. Someone who gets into it can read a closing statement or an engagement letter, then write to a client from your real address with new payment instructions. That’s much harder to spot than a message from a lookalike domain, because nothing about it is fake except the person typing.
For tax preparers, it isn’t optional. The FTC Safeguards Rule requires multi-factor authentication for anyone getting into the firm’s information systems, with one narrow exception that has to be approved in writing. Our page on data security for CPA firms covers what else the rule asks of a small practice.
Turning it on without locking yourself out
A few habits keep 2FA from turning into a headache:
- Start with email, then move on to the accounts that can move money or control your domain: banking, payroll, the domain registrar and your password manager.
- When you switch it on, save the backup codes the service gives you somewhere other than your phone.
- When you replace your phone, move the authenticator app across before you wipe the old one.
- Treat any sign-in prompt you didn’t start as a warning. Deny it, then change your password.
How it works on the mailboxes we run
When we set up Microsoft 365 mailboxes for a firm, multi-factor authentication is switched on during setup rather than sold back to you as an upgrade. The details, including how the mailboxes are priced, are on our pages for Microsoft 365 for law firms and Microsoft 365 for accounting firms.
If your firm’s mail is somewhere else, the advice above still holds. Turn 2FA on for the inbox today, and work outward from there.
Your Friends at Adams Digital
Ready to start Your Journey?
Click here to schedule a quick chat!
