MFA & Passkeys

Set Up MFA the Right Way

A plain-English guide to locking down your accounts with phishing-resistant multi-factor authentication and passkeys. No jargon, no SMS codes, no security background needed.

Free  ·  Works for Microsoft 365, Google, Apple, and every account that matters

~68%

of breaches involve the human element: stolen credentials, phishing, or a simple mistake.

Verizon DBIR

#1

Stolen credentials remain among the most common ways attackers break in, year after year.

Verizon DBIR

$16.6B

in reported cybercrime losses in 2024, a record high.

FBI IC3 Internet Crime Report

Required

Most cyber insurers will not write a policy, or pay a claim, without MFA in place.

Industry standard

Why this matters more than anything else

Your email is the master key to your whole digital life

If an attacker gets into your email, they can reset the password on almost every other account you own: your bank, your payroll, your ad accounts, your customer records. The vast majority of business breaches start with one stolen or guessed password. A second factor is what stops a stolen password from becoming a stolen company.

Passwords leak constantly

Reused and breached passwords are bought and sold in bulk. Yours may already be circulating from a site you signed up for years ago and forgot about.

A second factor blocks the takeover

Even with your password in hand, an attacker cannot get in without the second factor that lives on your device. That is the whole point of MFA.

Not optional anymore

MFA is table stakes

The data has been clear for years. The fastest, cheapest way for an attacker to get in is a stolen or reused password, and multi-factor authentication would have blocked most of those intrusions. It is now the baseline expectation for insurers, partners, and regulators alike.

If you do one thing for your security this quarter, make it this. Turn on a strong second factor everywhere it is offered, starting with your email.

What account takeover actually looks like

One stolen password rarely stays one problem

Here is how a single compromised login cascades across a business.

1

Ransomware foothold

A stolen login is often the attacker's first step inside. From one inbox they move sideways, find what matters, and deploy ransomware across the business. Most incidents start with a compromised account, not a movie-style hack.

2

Business email compromise

The attacker sits quietly in your inbox, learns how you write and who pays you, then emails your client or your finance team as you and redirects a payment. BEC is one of the costliest crimes the FBI tracks.

3

The account-takeover cascade

Your email is the reset button for everything else. With it, an attacker walks into your bank, payroll, ad accounts, and password manager. One inbox becomes the keys to the company.

MFA breaks the chain at step one. Every one of these scenarios starts the same way: someone logs in as you with a password that was never meant to be enough on its own. An authenticator app or a passkey is the wall that stops a stolen password from ever becoming a stolen company.

Not all MFA is equal

Skip SMS text codes

SMS is better than no second factor. But if you are setting things up today, do it once and do it right, because text-message codes are the weakest option available.

Weakest
SIM swapping. Attackers call your carrier, move your number to their phone, and receive your codes.
Weakest
Network interception. The aging SS7 phone network lets sophisticated attackers grab texts in transit.
Weakest
Phishable in real time. A fake login page simply asks you for the code and relays it to the real site the moment you type it.
Weakest
Officially discouraged. The U.S. standards body (NIST) has steered organizations away from SMS as a second factor for years.

Use an authenticator app instead

An authenticator app generates a fresh six-digit code on your device every 30 seconds. Nothing travels over the phone network, so there is nothing to swap or intercept. It is free, takes two minutes to set up, and works offline. Popular options include Microsoft Authenticator, Google Authenticator, and Authy. If you use a password manager like 1Password or Bitwarden, it can hold these codes too.

Even stronger than any code is a passkey. It cannot be phished at all, and Microsoft, Google, and Apple all support it today. That is the next section, and it is the one to remember.

The strongest option

Passkeys, explained properly

If you remember one thing from this page, make it this. A passkey is a cryptographic login tied to your device. You unlock it with your face, your fingerprint, or a small hardware security key. There is no code to type, so there is no code to phish or steal, and it simply will not work on a fake login page.

What a passkey actually is

When you create a passkey, your device generates a matched pair of cryptographic keys. The private key never leaves your device. It lives in a protected area of the hardware (the secure enclave on Apple devices, the TPM on Windows, similar hardware on Android) and it is released only after you unlock it with your biometric or device PIN. The website only ever receives the public key, which is useless to a thief on its own. There is no shared secret, no password, and no code sitting in a database waiting to be breached.

How it logs you in

Passkeys use an open standard called WebAuthn (part of the FIDO2 family) built on simple challenge-and-response:

The site sends a challenge

A one-time random value that is only valid for this login attempt.

You unlock the key

Face, fingerprint, or PIN. Your biometric never leaves your device or reaches the website.

Your device signs it

The private key signs the challenge, bound to the real web address you are on.

The site verifies

It checks the signature against your public key. Match means you are in. Nothing reusable ever crossed the wire.

Why it is phishing-proof by design

Whatever you do, do not rely on SMS text codes as your second factor. They can be SIM-swapped, intercepted, and phished in real time. Use a passkey where you can, an authenticator app where you cannot, and remove SMS everywhere a stronger method is offered.

Device-bound vs synced passkeys

There are two flavors, and the difference is about recovery versus assurance.

Synced passkeys

Stored in and synced across your devices by a provider such as iCloud Keychain, Google Password Manager, or a password manager like 1Password. If you lose a device, your passkeys are still available on the others. This is the right default for most people. The trade-off is that their safety now depends on the security of that platform account, so protect it with its own strong second factor.

Device-bound passkeys

Never leave the single device or hardware key they were created on. There is no cloud copy to compromise, which gives the highest assurance for high-risk accounts. The trade-off is recovery: if the device is lost and you registered no backup, you can be locked out, so always register a second key.

Hardware security keys, for the accounts that matter most

A hardware security key such as a YubiKey or a Google Titan key is a device-bound passkey in physical form. You tap or insert it to log in. For administrators, finance staff, and executives, whose accounts are the ones attackers hunt for, a pair of hardware keys (one to carry, one in a safe place as backup) is the strongest practical protection you can deploy today.

The honest limitations

How to add one: in your account's security settings, look for "Passkey" or "Windows Hello / Face ID," choose to add it, and confirm with your biometric or device PIN. It takes under a minute. The setup wizard below walks you through it for Microsoft 365 and Google.

The habit behind every account

Use a password manager

Reusing one password across accounts is the root cause of most takeovers: one site gets breached, and attackers try that same password everywhere else. A password manager fixes this by generating and storing a unique, strong password for every account, so a single leak can never cascade into your whole digital life.

Popular options include 1Password, Bitwarden, and the built-in Apple Passwords app. A good manager can also hold your authenticator (TOTP) codes and your MFA backup codes in one encrypted place, so your second factor and your recovery plan live somewhere you will actually find them. Put a passkey or an authenticator on the password manager itself, then let it carry the unique passwords for everything else.

Do it in order

Your MFA checklists

Two lists. The first turns MFA on the right way. The second closes the tricks attackers use to get around it. Tap each item as you finish, then print or save the page as a PDF to circulate.

MFA setup

0 of 7
  • Pick your second factor. An authenticator app, or a password manager with built-in codes. Best of all, a passkey.
  • Turn on MFA for email first (Microsoft 365 or Google), then every critical account: bank, payroll, ad platforms, domain registrar, and the password manager itself.
  • Remove SMS and phone-text as a method everywhere a stronger option exists.
  • Add a passkey wherever it is supported.
  • Save your backup and recovery codes in your password manager.
  • Use a password manager so every account has a unique, strong password.
  • Register a second device or backup key so you are never locked out.

MFA bypass prevention

0 of 6
  • Push bombing. Turn on number matching. Never approve a prompt you did not start, and report unexpected ones.
  • Adversary-in-the-middle. Use phishing-resistant MFA (passkeys or FIDO2 keys). Never sign in from a link in an email.
  • SIM swap. Do not use SMS. Set a port-out PIN with your mobile carrier.
  • Help-desk social engineering. Require identity verification before any MFA reset, and lock down recovery email and phone.
  • Legacy protocol bypass. Disable legacy or basic authentication in Microsoft 365 and Google so attackers cannot skip MFA entirely.
  • OAuth consent phishing. Review and limit the third-party app permissions granted to your email account.
Set it up now

The step-by-step wizard

Pick the email you use for work. Tap each step as you finish it, and watch the bar fill.

1

Install an authenticator app

On your phone, install Microsoft Authenticator (or Google Authenticator / Authy). It is free.

2

Open your security settings

On a computer, go to aka.ms/mfasetup and sign in. This is your Microsoft "Security info" page.

3

Add the authenticator app

Click "Add sign-in method," choose "Authenticator app," then "Work or school account." A QR code appears.

4

Scan the QR code

In the phone app tap the plus, choose "Work or school account," and scan the code on your screen. Approve the test prompt.

5

Make it your default and remove SMS

Set the authenticator app as your default sign-in method. If a phone-text method is listed, delete it so codes never go to SMS.

6

Strongest option: add a passkey

Back on the Security info page, add a "passkey" or "Windows Hello / Face ID" method. This is phishing-proof. Recommended.

1

Install an authenticator app

On your phone, install Google Authenticator (or Microsoft Authenticator / Authy). It is free.

2

Open Google security settings

On a computer, go to myaccount.google.com/security and sign in.

3

Open 2-Step Verification

Click "2-Step Verification." If it is off, turn it on. Then find "Authenticator app" and click "Set up."

4

Scan the QR code

In the phone app tap the plus, choose "Scan a QR code," and scan the code on your screen. Enter the six-digit code to confirm.

5

Remove SMS as a method

Under 2-Step Verification, remove "Voice or text message" so codes never go to SMS. Keep backup codes somewhere safe.

6

Strongest option: add a passkey

On the same page add a "Passkey" using Face ID, fingerprint, or a security key. This is phishing-proof. Recommended.

✓ You did it.

Your email is now protected with phishing-resistant MFA. Do this for every critical account, not just email: your bank, payroll, ad platforms, and password manager. Save your backup codes somewhere safe in case you lose your phone.

Where do you actually stand?

See your exposure in five minutes

MFA is one layer. Remi™ gives you a free Personal Cyber Score across everything that is exposed about you online, in plain English, and shows you what to fix first. No credit card, no security background needed.

Enforcing MFA across every employee, every app, and proving it for compliance is what a Cythentic™ virtual CISO engagement handles. Stolen credentials are the number one way ransomware gets in, so identity is the first layer we lock down.