MFA

How it works

• You sign in with something you know (a password) and something you have (a phone or key).
• Authenticator apps and security keys are stronger than text messages.
• It stops most account takeovers that start with a stolen or reused password.
• Turn it on first for email, banking and anything holding client data.

What can go wrong (example scenario)

A three-person recruiting firm had MFA off “because it was annoying”. A reused password from an old breach let an attacker into the owner's mailbox. He read client contracts for a month and then sent fake invoices from her address.

How WILDCARD handles it

Password Manager puts strong, unique passwords and SSO behind MFA. Identity Monitor watches every login and session and shuts down suspicious activity automatically. Cloud covers the sign-in settings in your Microsoft 365 or Google tenant.

• A dental office enables MFA on Microsoft 365 for all staff, with the authenticator app on each phone.
• A law firm requires a hardware key for partners who access trust accounting.
• A contractor turns on MFA for the bank and the accounting software, the two accounts that move money.

Example scenario: A small marketing studio's designer had her password phished through a fake Adobe login. The attacker tried to sign into Microsoft 365 from overseas that night. MFA stopped him cold, the login attempt showed up in monitoring, and her password was changed before breakfast.

A question owners ask

Is MFA on my phone really enough?

For most accounts, an authenticator app is a huge improvement. For accounts that move money or hold client data, a hardware key is the step up because it can't be phished.