MFA can stop an attack. Don’t give away the second key.

You enter your password.

Then your account asks for another verification step.

That is multi factor authentication, or MFA.

It can protect you even when your password has been stolen.

But there is a catch.

An attacker who has your password may try to trick you into giving them the second factor too.

You might receive a message saying:

“Tell me the code you just received.”

Or a fake website may ask you to enter a code while the attacker is attempting to sign in.

Never approve or share a verification code for a login you did not initiate.

Where available, consider using an authenticator app, passkey or security key. SMS codes can still provide useful protection when that is the available option.

Pay attention to unexpected login prompts. If one appears when you are not trying to sign in, do not approve it.

If you receive an unexpected one time code, treat it as a warning that someone may be attempting to access your account.

Think first. Click safe.

MFA gives you another layer of protection.

Don’t become the person who removes that layer for the attacker.