A password always ends up circulating. It leaks in a breach at a third-party service, it is typed into a fake login page, or it is reused from one site to another until one of them is compromised. The problem is not carelessness on your employees’ part, it is the very nature of a secret that has to be typed several times a day.
Two-factor authentication starts from this observation. Rather than trying to stop a password from leaking, it ensures that a leaked password is no longer enough. It is, after backups, the measure that offers the best ratio between the effort required and the protection gained.
What is two-factor authentication?
Two factors means two proofs of identity of a different nature: something you know, the password, and something you have, your phone or a small key. You encounter this principle every day without thinking about it: a bank card at an ATM only works together with its PIN.
In practice, for the user, nothing changes except one extra step. They type their password as usual, then a screen asks for a six-digit code which they read on their phone. This takes about five seconds.
You will come across several names for the same thing: 2FA, MFA, strong authentication, two-step verification. The term MFA, for multi-factor authentication, is simply the broad term. In an SME, they all describe the same action.
Why does this measure neutralise password theft?
Look at how an ordinary attack unfolds. The attacker obtains a list of credentials, through a leak at a supplier or through a fake login page. They try these credentials against hundreds of services, automatically. When one works, they get in.
The second factor breaks this chain at the last link. The attacker has the password, but does not have the phone sitting on your accountant’s desk. The login fails, and your employee receives a validation request they did not trigger, which alerts you in the process.
It is also the most effective defence against classic phishing. A fake page that imitates your webmail collects the password, but the code shown on the phone changes every thirty seconds and is worthless a few moments later. The full mechanism is described in our article on phishing.
An office manager reuses her business e-mail password on a supplies ordering website. That site is hacked, the credentials are sold on. Three months later, someone attempts to log into her mailbox from abroad. With a second factor, the attempt fails and she receives a notification. Without it, the attacker reads her correspondence for weeks before impersonating her to a client.
Where to start? Two accounts, not thirty
The classic mistake is trying to cover everything at once, then giving up in the face of the scale of the task. Start with the two accounts whose compromise would do the most damage.
The business mailbox first. It is the company’s most critical account, and rarely the one people think of first. Your mailbox holds the history of your exchanges with clients, suppliers and your bank. Above all, it is used to reset passwords for almost all your other services: whoever controls the mailbox ends up controlling the rest. The concrete consequences are detailed in our article on e-mail compromise.
Online banking next. In Switzerland this is generally already the case, since institutions require it. Still, check secondary access points: payroll payment tools, invoicing platforms, the compensation fund portal.
Once these two accounts are covered, extend at whatever pace suits you: accounting tools, business management software, remote access, hosting platforms, the company’s social media accounts. Remote access deserves particular attention as soon as part of the team works outside the premises, a situation covered in remote work and mobile devices.
The three common forms, and what sets them apart
Not all forms of second factor are equal. Here is how they compare with one another.
| Form | How it works | Robustness | Who it suits |
|---|---|---|---|
| SMS code | A code arrives by text message on the registered number | Decent, but the weakest of the three | Those with no other option, or for a quick start |
| Authentication app | An app on the phone generates a code that changes every 30 seconds | Good, and free | The default choice for an SME |
| Physical key | A small object to plug in or bring close to the phone | The highest, resists fake pages | Management, IT, access with payment authority |
The authentication app has a discreet but decisive advantage: it works without a network connection, since the code is calculated on the device itself. It therefore depends neither on the carrier nor on mobile coverage.
The physical key goes even further. It verifies the site’s address before responding, which makes it immune to fake login pages: even a tricked employee cannot validate a login to a fraudulent site. Its cost remains modest, and it is fully justified for accounts that authorise payments.
A code sent by SMS can be intercepted, and there is a fraud technique that consists of having a phone number transferred to a new SIM card in order to receive the codes in place of the holder. These attacks are real, but they require a targeted effort, whereas almost all the attempts an SME faces are automated and stop dead in front of any second factor. If SMS is your only option, activate it today. You can switch to an app later, when that becomes possible.
The objections you will hear
They are always the same ones, and they all have a simple answer.
“It will waste our time.” Count five seconds, a few times a month, on a usual device. Compare that to the days of lost activity following the compromise of a mailbox.
“I do not want to use my personal phone for work.” The objection is legitimate and deserves a real answer, not a forced push-through. An authentication app gives the employer no access to the phone and transmits no data. If reluctance persists, a physical key provided by the company settles the matter for good.
“We are too small to interest anyone.” Attacks using stolen credentials do not choose their target, they test lists. The size of the company plays no role in whether it is targeted, only in its capacity to absorb the impact.
“What if I lose my phone?” This is the only objection that requires real preparation. Generate the backup codes at the time of activation, keep them outside the information system, and register a backup second factor for important accounts.
What MFA does not protect against
An honest measure is also judged by what it lets through.
It does not protect an already infected machine. If malicious software is installed on the computer, it can act from a session that is already open, without ever having to re-authenticate.
It does not protect against advanced phishing, where the attacker relays in real time the code you just entered. Only the physical key blocks this scenario.
Above all, it does not protect against fraud that exploits no technical flaw at all. In CEO fraud, the transfer is carried out by an authenticated employee, in good faith, on the order of a fake executive. No second factor comes into play, because there is nothing to bypass.
Ticking a box in the settings is within anyone's reach. Drawing up the full list of access points that matter within your company is much less so. Almost every SME forgets the same things: the website's admin account, remote access opened for a supplier three years ago, the shared generic mailbox used by several people, the account of an employee who left last year. These forgotten access points are precisely the ones no one watches, and a serious inventory requires a trained eye that knows where to look.
This mapping exercise stands on its own. It cross-checks the services you pay for, the ones your teams have set up without mentioning it, and the ones your suppliers use within your company. The result often surprises owners with its length.
You can start on your own today, and that is what you should do: these measures form a useful foundation, but they do not replace an assessment of your own situation. To spot accounts already exposed, the password leak check tool gives a first signal, and the cyber check-up situates your overall level. The other priority measures are grouped in the Best practices pillar.