Overview

Most break-ins to business accounts do not involve anything clever. Someone gets hold of a password, types it in, and they are in. The password might have been guessed, reused from another site that was breached, or handed over on a fake login page. Two-factor authentication, usually shortened to 2FA, is the one setting that makes a stolen password useless on its own.

If you have ever had your bank send a code to your phone before letting you log in, you have already used it. This article explains what is happening behind that step, why we treat it as a requirement rather than a preference, and what it takes to get it switched on across a whole business.

What 2FA actually is

Logging in normally asks for one thing: something you know, which is your password. Two-factor authentication adds a second thing: something you have, which is usually your phone. To get in, an attacker would need both. Knowing your password is not enough if they do not also have the device sitting in your pocket.

The second factor most people see is a six-digit code from an authenticator app, or a notification on the phone asking "Is this you?" with an Approve button. Text message codes still exist, but they are the weakest option and we move clients away from them where we can.

How it works day to day

In practice it is less disruptive than people expect. You enter your password as usual. On a device you have used before, that is often the end of it. On a new device, a new location or after a set period, you are asked to confirm on your phone. Tap approve, or type in the code, and you are through. The whole thing takes a few seconds and most staff stop noticing it within a week.

Behind the scenes, the app on your phone and the service you are logging into share a secret that was set up when you first enrolled. The code the app shows changes every 30 seconds and is generated from that secret plus the current time. Nobody else can produce the same code without the phone, and a code that has been used or has expired is worthless.

If someone is asking you to read out or type in your 2FA code, that is the attack. The code is for you to enter, never to share.

Why it is not optional any more

Passwords leak constantly. Large breaches at other companies release millions of email and password pairs, and attackers run those lists against Microsoft 365, Google, Xero and every other business service on the assumption that people reuse passwords. Many do. A phishing email that captures one login can be enough to read a mailbox, redirect a supplier payment or reset the passwords on everything else.

With 2FA turned on, those attacks stop at the door. Microsoft's own figures put the reduction in account compromise at over 99 percent for accounts with it enabled. Cyber insurers now ask about it before they will quote, and several will decline cover or a claim without it. Industry and government frameworks in New Zealand list it as a baseline control, not an advanced one.

The other reason it is not optional is that one unprotected account is enough. Security settings that are "mostly on" give a false sense of safety. Attackers do not need the director's login if the accounts inbox or a shared mailbox is still open.

Where businesses fall short

In the accounts we review, the pattern is usually the same. 2FA was recommended to staff but not enforced, so some people set it up and others did not. Shared logins for a generic mailbox or a software subscription were left out because nobody was sure whose phone should get the code. Old accounts for people who have left were never closed. And the systems outside Microsoft or Google, such as accounting, payroll, the website host and the domain registrar, were forgotten entirely.

How New Solutions can help

Turning 2FA on for yourself takes two minutes. Making sure it is on for every account in the business, and stays on, is the part that takes some organisation. This is work we do for clients as part of managed IT support, and it looks like this:

Audit. We list every account and service the business uses, including the ones outside your main email platform, and check which have 2FA enforced, which have it available but unused, and which do not support it.

Enforce rather than encourage. In Microsoft 365 and Google Workspace we set policies that require 2FA for everyone, so a new staff member cannot skip it and an existing one cannot switch it off. Where a service has no way to enforce it, we track it and check it.

Handle the awkward cases. Shared mailboxes, service accounts and logins for the boardroom TV all need a sensible approach. We sort out who holds the second factor and document it, so nobody is locked out when someone is on leave.

Roll it out without a bad day. We schedule the change, tell staff what to expect, help anyone who gets stuck and set up backup methods so a lost phone does not become a lost week.

Keep checking. Accounts get added and people move on. We review regularly so the coverage you had at the start is the coverage you still have a year later.

If you are not sure whether every account in your business has 2FA enforced, that is the answer. Get in touch and we will run through it with you.

Overview

Nearly every security incident our team is called into begins the same way: one person, in a hurry, opens an email that looks exactly like the ones they get every day. The technology behind these attacks has improved, and the spelling mistakes we used to rely on as a warning sign have largely disappeared.

Good filtering stops most of it. What matters is what happens to the small number of messages that get through. Below are the five checks we teach client teams to make, in the order they are quickest to apply.

1. The request creates urgency

Payment must be made today. The account will be closed within the hour. The manager is in a meeting and cannot take a call. Urgency is the one feature almost every phishing email shares, because it discourages the pause in which someone would normally check. Treat a deadline in an email as a reason to slow down, not speed up.

2. The reply address is not the display name

A display name is free text and can say anything. Expand the sender field and read the full address, then read it again from the right: the domain at the end is the part that cannot be faked. Lookalike domains that swap a letter or add a hyphen are common, and they are much easier to spot when you know to check the last part first.

3. The link text and the link destination disagree

Hover over a link before clicking and compare what it says with where it goes. On a phone, press and hold to preview the address. Attachments deserve the same treatment: a document that asks you to click through to a second site to view it is worth a phone call.

If an email asks you to change bank details, confirm it by phone on a number you already have. Not the number in the email.

4. It asks for credentials or a code

No supplier, bank or IT provider needs your password, and none of them will ask for the six-digit code from your authenticator app. If a login page appears after clicking an emailed link, close it and reach the service through a bookmark or by typing the address yourself.

5. Something about it is slightly off

A supplier who has never emailed an invoice suddenly does. A colleague writes in a tone they do not usually use. A thread appears to continue a conversation you do not remember having. Staff instincts are accurate more often than they are given credit for, and the cost of asking is a two-minute interruption.

Make reporting easy

The single most useful change most businesses can make is giving people one obvious place to send a suspicious email, and thanking them when they do. If reporting feels like admitting a mistake, people delete instead, and you lose the chance to check whether anyone else received the same message.

If you would like us to review your email security settings or run a short awareness session with your team, get in touch and we will talk through the options.