Multi-Factor Authentication
Authentication is the process used to verify a person’s identity. In IT systems, this typically involves verifying a user through a username and password entered when logging in to a particular system.
Multi-factor authentication (MFA) is a security process that requires two or more independent factors to verify a user’s identity. In addition to entering a username and password, users must confirm their identity in another way (for example, by entering a one-time code from a mobile app or SMS message, or by using biometric data such as a fingerprint or facial recognition).
Multi-factor authentication may also be referred to by other terms, such as multi-step verification or two-factor authentication (2FA).
Why MFA is important
- Improved security: It makes it more difficult for unauthorised individuals to access online user accounts, even if they know the password.
- Protection of sensitive data: It reduces the risk of identity theft and data breaches involving information stored in online accounts such as internet banking, email accounts, or social media platforms.
How MFA works
MFA usually combines something the user knows (such as a password or PIN), something the user has (such as a code from a mobile app, SMS message, or hardware key), or something the user is (biometric data). This provides stronger protection against unauthorised access because an attacker would need to obtain two separate authentication factors in order to log in.
- First factor (knowledge): The user enters their usual username and password.
- Second factor (possession or biometrics): After successfully entering the first factor, the system requests a second verification method. This may include:
-
- Code from an SMS message or app: A one-time password (OTP) sent to a registered mobile phone or generated in a mobile application (such as Microsoft Authenticator or Google Authenticator).
- Hardware key: A physical USB key, smart card, or similar device connected to a computer for verification.
- Biometric verification: A fingerprint, facial recognition, or another biometric characteristic.
How a one-time OTP code works
An OTP code (One-Time Password) is a temporary security code used to verify a user’s identity for a single login session or transaction. Unlike standard passwords, an OTP code is valid only for a short period of time (typically 30–60 seconds) and can only be used once. After it has been used, it immediately becomes invalid and cannot be reused for another login attempt. This significantly improves security and reduces the risk of misuse. OTP codes may be sent via SMS or email, or generated by an authentication app.
Authenticator apps
An authenticator app is a dedicated verification application that must be installed on a device (typically a smartphone or tablet) and is used to generate OTP codes. Popular and recommended apps include Microsoft Authenticator and Google Authenticator, or other apps. The main advantages of these apps are that they are independent of a phone number, so users do not need to provide one, generate one-time codes even without an internet connection (Wi-Fi) or mobile signal, only require the device’s time settings to be correctly synchronised. User accounts can be added to an authenticator app simply by scanning the relevant QR code.
Setting up MFA
- Install an authenticator app for generating OTP codes on your smartphone. These apps are available free of charge on Google Play or the App Store. If you already have an authenticator app installed, you can skip this step.
- Add your user account to the authenticator app by scanning the relevant QR code using your phone’s camera. Each user is assigned a unique QR code containing a unique key used to generate OTP codes.
- A new account will then appear in the authenticator app. A new six-digit OTP code will be generated every 30 seconds, which you will use as your second authentication factor.
TBU users will add their account to the authenticator app during the activation process for their TBU user account, when the relevant QR code will be displayed. Before activating your user account, you must already have an authenticator app installed on your mobile phone. Setting up MFA is required in order to complete the user account activation process successfully.