What is Multi-Factor Authentication? 

MFA, sometimes referred to as Two- Factor Authentication (2FA), requires users to provide two or more forms of verification before gaining access to an account. Rather than relying on a password alone, it adds a second layer of protection through something you know, something you have, or something you are. 

Common methods include a mobile phone approval notification, a code from an authenticator app, a fingerprint or facial recognition, or a physical security key. Even if a cyber-criminal obtains your password, they will typically be unable to log in without that second factor. 

A Real-World Example: The CEO Fraud Attempt

Consider this scenario. An employee receives what appears to be an urgent email from the CEO requesting payroll information. It looks genuine and creates a sense of urgency. 



What the employee does not know is that a cyber-criminal had already stolen their password earlier in the week through a phishing attack. 

That evening, the attacker attempts to log in to the organisation's Microsoft Office 365 environment using the employee's credentials. They’re correct. Normally that would be enough. 

However, the organisation has MFA enabled. 

Instead of granting access, Microsoft sends a sign in approval request to the employee's phone. The employee, not attempting to log in and not expecting a notification, immediately recognises something is wrong. They deny the request and report it to their IT team. The compromised password is reset before the attacker can reach any systems or information. 

In this case, MFA didn’t just stop the attacker, it alerted the employee that someone was actively attempting to access their account, giving the organisation time to respond before any damage occurred. 

What could have happened without MFA? 

Without MFA, the attacker would have gained immediate access to the employee's account. 

Within minutes, they could have: 

• Read emails and internal conversations 
• Accessed payroll or customer information 
• Sent convincing emails from the employee's account 
• Requested fraudulent payments from Finance 
• Reset passwords to other connected systems 
• Distributed phishing emails internally to compromise additional staff

What starts as a single stolen password can quickly escalate into financial loss, data breaches, regulatory reporting obligations and lasting reputational damage. Many significant cyber incidents begin with nothing more than a compromised username and password. 

Why it matters for your organisation

Every organisation relies on digital systems - mail platforms, cloud applications, payroll, customer databases and collaboration tools all contain information that cyber criminals actively seek to exploit. MFA is one of the simplest, most cost effective security measures available, and the Australian Cyber Security Centre (ACSC) identifies it as one of the most effective controls organisations can implement to prevent unauthorised access. 

Whether you’re part of a large organisations, a school, a not-for-profit or a small business, MFA significantly reduces the likelihood of a breach – even when passwords have already been stolen.

Don’t forget your personal accounts 

Cyber security is not just an organisational responsibility. Individuals should also enable MFA wherever possible, particularly for: 

• Email accounts 
• Online banking 
• Social media 
• Cloud storage 
• Government services 
• Shopping and payment platforms 

Your email account is often the gateway to your digital life. If a cyber-criminal gains access, they may be able to reset passwords across other accounts and commit identity fraud. Enabling MFA takes only a few minutes and make a significant difference.