Multi-Factor Authentication Has Changed. Has Your Business Kept Up?

MFA Still Matters, but Not All MFA Is Equal

For a long time, turning on Multi-Factor Authentication felt like a big win for security. And it was.
MFA still matters today, but the way attacks happen has changed.
Some older methods just don’t protect businesses the way they once did.

The most common example is text messages. Those four- or six-digit codes sent by SMS are familiar and convenient, and they’re better than passwords alone.
The problem is that SMS was never designed to be a secure authentication channel.

Why Text Messages Are Becoming a Risk

One of the biggest risks we see is SIM swapping. Instead of hacking a computer, an attacker calls a mobile carrier, pretends to be the account owner, and convinces support to move the phone number to a new SIM card.
When that happens, the attacker receives your login codes while your phone goes offline.

SMS codes are also easy to steal through phishing. If someone enters their username, password, and texted code on a fake login page, an attacker can use all of it immediately.
From the user’s perspective, everything looks normal until access is already lost.

What Phishing-Resistant MFA Does Differently

Newer MFA methods remove the weak link. Instead of relying on codes that can be intercepted or reused, phishing-resistant MFA ties access to a specific device and a specific website.
Even if someone clicks the wrong link, the login simply won’t work.

This can include hardware security keys, modern authenticator apps, or passkeys protected by biometrics.
These options eliminate text messages and significantly reduce the chance of user error.

Security That Works With People, Not Against Them

Any security change needs buy-in. People are used to text messages, so switching methods can feel uncomfortable at first.
When users understand the real risks, adoption becomes much easier.

For higher-risk accounts like administrators and executives, stronger MFA shouldn’t be optional.
These accounts are prime targets and deserve the highest level of protection.

Our Advice From RIT Company

If your business is still relying on SMS for MFA, this is a good time to reassess.
You don’t need to replace everything overnight, but you do need a plan.

Our recommendation is simple:

• Keep MFA everywhere
• Stop using text messages for sensitive or privileged accounts
• Move toward phishing-resistant options that are easier for users and harder for attackers

This is one of the most practical security upgrades a business can make.

If you’re not sure where to start or want a second opinion on your current setup, reach out. We’re always happy to talk it through and help you choose what makes sense for your business.

Greg

Swiecicki

Author