MFA is not one thing, and the differences matter
'We have MFA enabled' can mean very different levels of real protection. SMS codes, authenticator apps, and hardware security keys all satisfy a checkbox for multi-factor authentication, but they resist attackers very differently. Choosing the wrong method for a sensitive account is a common reason accounts still get taken over despite MFA being 'on'.
SMS codes: better than nothing, weaker than it feels
Text-message codes are the most familiar MFA method and better than no MFA at all. But they are vulnerable to SIM-swap attacks, where an attacker convinces a carrier to move your phone number to their device, and to real-time phishing pages that relay the code the moment you type it.
- Reasonable for low-risk personal accounts where nothing better is offered
- Not recommended as the only MFA method for email, banking, or admin accounts where a takeover would be costly
- SIM-swap risk can be reduced with a carrier PIN or port-protection feature, but this does not fully close the gap
Authenticator apps: a solid default for most people
Apps that generate time-based codes on your device, without needing your phone number, remove the SIM-swap risk entirely and are widely supported. They are a strong default for most staff and personal accounts.
- Codes are generated on-device and do not depend on cellular service or carrier security
- Still vulnerable to real-time phishing where a fake login page relays the code instantly to the attacker
- Back up recovery codes when setting up an authenticator app, since losing the device without a backup can lock you out
Hardware security keys: the strongest practical option
Physical keys using modern standards are resistant to phishing in a way codes are not, because the key cryptographically verifies the actual website rather than just producing a number an attacker can relay.
- Recommended for admin accounts, executives, finance staff, and anyone handling wire transfers or sensitive data
- Practical for small teams: most staff need only one or two keys, kept on a keychain
- Register a backup key or backup codes in case the primary key is lost
A practical rollout order for a small business
You do not need to solve every account at once. Prioritize by what an attacker would actually want.
- Start with admin, finance, and executive email accounts: move these to hardware keys or authenticator apps first
- Move general staff accounts to authenticator apps as a default
- Reserve SMS for the accounts that offer nothing stronger
- Disable legacy sign-in methods that can bypass MFA entirely, a common gap in older Microsoft 365 tenants
Frequently asked questions
Is MFA annoying enough that staff will try to avoid it?
Some friction is normal at first. Authenticator apps with 'remember this device for 30 days' options reduce daily friction substantially while keeping protection strong. The inconvenience is minor compared to the cost of an account takeover.
Can hardware keys be lost or broken?
Yes, which is why every account should have a registered backup method, either a second key or one-time backup codes stored securely offline. Losing the only MFA method with no backup is the main real drawback, and it is fully preventable with setup discipline.
Do we need hardware keys for every employee?
Not necessarily. Reserve hardware keys for the highest-risk roles first, admin, finance, and executives, and use authenticator apps as a strong, lower-friction default for everyone else. This balances cost and protection sensibly for most small teams.