Text codes, apps or security keys: which MFA method should your staff use?

Why the method matters

Multi-factor sign-in has become standard, and attackers have adjusted. Instead of giving up when they meet MFA, they now try to defeat the weaker kinds. They trick people into reading out codes, flood phones with approval requests, take over phone numbers, or use relay websites that pass your sign-in through to the real service and steal the result. Choosing the right method for each person balances security, cost and convenience. A receptionist and a finance manager don't need identical protection, but both need more than a password, and the people who can move money need the most.

Text message codes

A code sent by SMS is easy to set up and works on any phone, which is why so many services use it. Its weaknesses are well known. Phone numbers can be hijacked through SIM swap fraud, where a criminal convinces a carrier to move your number to their SIM. Codes can also be phished: a fake page asks for the code and passes it straight to the real site. SMS is still far better than no MFA, and for some services it's the only option offered. But for work email and key business systems, aim to move staff to something stronger.

Authenticator apps and push approvals

Authenticator apps generate a short-lived code on the phone itself or send a sign-in prompt to approve. They don't rely on the phone network, so SIM swap fraud doesn't affect them. Microsoft Authenticator is the natural choice for Microsoft 365, and Google's and other apps work with a wide range of services.

Push approvals had a weakness: people tapped 'approve' on prompts they didn't start, especially when bombarded at night. Number matching fixes most of this by showing a number on the sign-in screen that must be typed into the app, so an attacker's prompt can't be approved blindly. Make sure it's switched on.

Passkeys

A passkey replaces the password with a cryptographic key stored on your phone, laptop or password manager, unlocked with your fingerprint, face or device PIN. When you sign in, the device proves who you are without sending anything a scammer could reuse. Crucially, a passkey is tied to the real website's domain, so it simply won't work on a fake page. Microsoft, Google, Apple and many other services now support passkeys, and Microsoft Authenticator can hold passkeys for work accounts. Setup has become much easier. For many staff, passkeys offer stronger security with less friction than codes.

Hardware security keys

A hardware security key is a small device that plugs into a USB port or taps against a phone using NFC. Like a passkey, it's bound to the real website and resists phishing. Because it's a separate physical object, it's also independent of a phone that might be lost, stolen or compromised.

Keys cost a modest amount each and are worth considering for administrators, directors, finance and payroll staff, and anyone with access to large amounts of sensitive data. Give each person two keys, one for daily use and a backup kept somewhere safe, so a lost key doesn't lock them out.

Matching methods to people

A practical approach for a small office is a baseline and a step up. The baseline for all staff is an authenticator app with number matching, or a passkey where supported. The step up for admins, finance and senior staff is a hardware key or device-bound passkey, with sign-in limited to company-managed devices where your licence allows. Remove SMS as an option for work accounts once staff are on stronger methods, or attackers will simply target the weaker fallback. Check that recovery processes don't quietly undo your work, for example by letting anyone reset MFA after a phone call.

Rolling out stronger methods gradually

You don't have to change everything at once. Start with admin accounts, then finance, then everyone else. Give people a short demonstration and written steps for their phone type. Expect a few support requests in the first week and have someone available to help. Review the setup once a year. Methods and best practice keep improving, and what's optional in your system today may become a simple setting tomorrow. If you're not sure which methods your current licences support, your IT provider can check and plan the change.

Keep a simple record of which method each person uses and which accounts still rely on text codes. That list becomes your to-do list for the next round of improvements, and it's useful evidence if an insurer or a large client asks how you protect sign-ins. Pick a quiet week for the change rather than the end of a month or a deadline period.