What is multi-factor authentication (MFA)?

MFA means signing in needs more than a password: something you know (the password) plus something you have (a phone, an app or a security key) or something you are (a fingerprint or face). If a criminal steals or guesses the password, they still cannot get in without the second factor. It is one of the most effective and cheapest security measures a small business can switch on. Two-factor authentication (2FA) is simply MFA with two factors.

Is MFA free for a small business?

Basic MFA is included with common business platforms, including Microsoft 365 and Google Workspace, and authenticator apps are free. Hardware security keys cost money, and finer control over who needs MFA and when depends on your licence, for example the more advanced controls in some Microsoft 365 plans. Check what your own plan includes rather than assuming, because licence details change.

Is SMS a good second factor?

It is better than a password alone, but it is the weakest common option. Text messages can be redirected through a SIM swap, which is a recognised fraud risk in South Africa, and they depend on mobile signal. Use an authenticator app with number matching, or better a passkey or security key, and keep SMS only as a last-resort backup for people with no alternative.

What is an MFA fatigue attack?

It is when an attacker who already has a password triggers sign-in prompts again and again, hoping the user will tap approve to make them stop. Number matching, where the user must type the number shown on the sign-in screen, and training staff to refuse and report any prompt they did not start, defeat most of it. Phishing-resistant methods such as passkeys avoid the problem altogether.

Does MFA stop all phishing?

No. Some phishing pages act as a middleman, relaying your password and your code to the real site in real time and capturing the signed-in session. That is why the strongest methods, passkeys and hardware security keys, are recommended for owners, administrators and anyone who handles payments. They only work on the genuine site, so a fake page cannot use them.

What if someone loses their phone?

Plan for it before it happens. Register a backup method for each person, keep two emergency administrator accounts with long unique passwords stored offline, and write down who can approve a reset and how they verify the person asking. An attacker who phones the helpdesk pretending to be a colleague is a common way around MFA, so the reset process matters as much as the technology.

Do cyber insurers and POPIA require MFA?

Cyber insurers commonly ask about MFA on email and remote access, and a missing answer is one of the most frequent reasons for a declined application. POPIA does not name MFA, but it requires reasonable security measures for personal information, and MFA is widely regarded as part of that. See our guides to what insurers ask for and to the POPIA technical checklist.

MFA for Small Business in SA: Methods and Rollout Plan

Most of the business email compromise, fake invoices and account takeovers that hurt South African small businesses start the same way: someone gets hold of a password. They guess it, buy it from an old breach, or trick a staff member into typing it into a fake page. Multi-factor authentication (MFA) breaks that chain, because the password alone is no longer enough. This guide explains what MFA is, how the different methods compare (authenticator apps, text messages, passkeys and security keys), which accounts to protect first, the attacks that still get through and how to stop them, a rollout plan that works for a small team, and a planner that builds one for your business. IT-Support-SA provides IT support from Pietermaritzburg to businesses across KwaZulu-Natal and the rest of South Africa.

The Short Answer

Switch on MFA for every email and cloud account, starting with owners, administrators and anyone who handles payments. Use an authenticator app with number matching for most people, and a passkey or hardware security key for the accounts that matter most. Keep text messages as a last-resort backup only. Close the side doors (remote access and old sign-in methods that skip MFA), plan for lost phones before they happen, and tell staff to refuse any prompt they did not start. It costs little and removes a large share of the easiest attacks.

What MFA Is

A password is something you know. MFA adds a second kind of proof: something you have (a phone with an app, a security key) or something you are (a fingerprint or face). To get in, an attacker needs both, so a stolen password on its own is useless.

It does not need to be a nuisance. Most people tap a prompt on a phone or touch a key, and many sign-ins are remembered on trusted devices so it is not asked every time.

The Methods, From Weakest to Strongest

Password alone is not acceptable for email or cloud accounts. Beyond that, the methods fall into three tiers:

Avoid as the main method: text messages and email codes. They are better than a password alone, but they are the easiest to attack. SIM swap fraud, where a criminal gets your number moved to a SIM they control, is a recognised risk in South Africa.
Good for most people: an authenticator app, ideally with number matching, where you type a number shown on the sign-in screen so you cannot approve a prompt you did not start.
Best for the accounts that matter: passkeys and hardware security keys. They are tied to the genuine website, so even a perfect fake sign-in page cannot capture them.

Which Accounts First

If you do nothing else, protect these, in this order:

Administrator accounts on Microsoft 365, Google Workspace, your domain registrar, your website and your backup system. Whoever controls these controls the business.
The owner’s and directors’ mailboxes, because email resets every other password.
Anyone who pays suppliers or can change banking details. Our guide to invoice fraud and fake banking details emails shows how one unprotected mailbox turns into lost money.
Remote access: VPN, remote desktop and remote-support tools. Open or password-only remote access is a common way ransomware gets in. See our ransomware protection guide.
Everyone else, on email and cloud files.
Accounting, payroll, banking portals, CRM and social media, wherever the product offers it.

The Attacks That Still Get Through

MFA is not magic. Four things to know:

MFA fatigue

An attacker who already has a password triggers sign-in prompts repeatedly, hoping a tired or confused user taps approve. Defence: number matching, and a rule that nobody approves a prompt they did not start. Report it, because it means the password is already stolen.

Phishing that relays your code

Some fake sign-in pages sit in the middle: they pass your password and your code to the real site in real time and keep the signed-in session. Defence: passkeys and security keys, which only work on the genuine site, for owners, administrators and finance.

SIM swap

If your second factor is a text message, a criminal who persuades a mobile network to move your number to their SIM receives your codes. Defence: do not use SMS as the main method.

The helpdesk back door

A caller pretending to be a colleague who “lost their phone” asks for an MFA reset. Defence: a written reset procedure that verifies the person through a known channel, such as a call to a number you already have, and a named person who is allowed to approve it.

The Side Doors

Switching MFA on for the front door is not enough if a side door is open:

Old sign-in methods. Some older email protocols and apps do not support MFA and can be used to skip it. Most platforms have been closing these, but check that yours has, and that nothing in your business still depends on them.
Remote desktop and VPN. Put MFA on them, and never leave remote desktop open to the internet.
Shared mailboxes and service accounts. Make sure they cannot be signed into directly, or that they are protected another way.
Emergency accounts. Keep two administrator accounts with long unique passwords stored offline, so a lost phone cannot lock you out of everything.

If you run Microsoft 365, the licence decides how precisely you can control all this. Our comparison of Business Premium and Standard explains the difference.

Plan Your Rollout

Answer five questions. The planner gives the right method for each group of people, a rollout in four waves and the traps to watch for.

INTERACTIVE PLANNER

Plan your multi-factor authentication rollout

Answer five questions. You get the right method for each group of people and a rollout in order.

The start-up selection describes a typical 6 to 25 person Microsoft 365 business where everyone has a smartphone and someone handles supplier payments. Change the answers and watch the recommendations move: shared devices push you towards individual security keys, remote access adds its own step, and a larger team changes how you pilot. The timings are rough planning guides, not promises.

How to Roll It Out Without a Revolt

Most MFA projects fail on people, not technology. What works:

Start small. Administrators and owners first, then a pilot group, then everyone.
Explain why. One short message: “A stolen password alone will no longer get anyone into our email, and this is how we stop fake invoices.” Staff cooperate when they understand it protects them and the business.
Set a date and keep it. A deadline with help available works better than an open-ended invitation.
Make it easy. A ten-minute session with someone to help beats a long email of instructions.
Plan for the phone. Tell people to move their authenticator to a new phone before wiping the old one.
Do not forget leavers and starters. A new person registers on day one, and a leaver loses access on their last day. Our IT offboarding checklist covers the leaver side.

MFA, POPIA and Cyber Insurance

Two reasons beyond security itself. Insurers commonly ask whether MFA is on for email, administrators and remote access, and a “no” is one of the most frequent reasons for a declined application: see what cyber insurers ask small businesses to have in place. And POPIA requires reasonable security for the personal information you hold. It does not name MFA, but a business with customer or patient data and no MFA on email is hard to defend as reasonable. Our POPIA IT compliance checklist covers the wider measures, and our guide to IT support for medical practices shows the stakes where patient records are involved.

How IT-Support-SA Can Help

We can plan and carry out the rollout: checking your Microsoft 365 or Google settings, enforcing MFA for administrators first and then the team, setting up passkeys or security keys for the accounts that matter, closing remote-access and legacy sign-in gaps, writing the reset procedure and training your staff. If you want to know where you stand first, we can review your accounts and give you a plain list of gaps in order of importance. See our IT support services or get in touch. We support businesses across Pietermaritzburg, the KZN Midlands, Durban, Ladysmith, Johannesburg, Cape Town and all 9 provinces of South Africa.

Mistakes That Leave the Door Open

MFA on email only, with administrators, remote access and cloud apps still on passwords.
Text messages as the main method for everyone.
No plan for lost phones, so the reset process becomes the weak point.
Approving prompts without checking, which is how fatigue attacks work.
Skipping the owner and the finance person because “they are too busy”.
Leaving old sign-in methods open that bypass MFA.
No emergency administrator accounts, so one lost phone locks the business out.
Switching it on once and never checking who is actually enrolled.

Conclusion

MFA is the cheapest, fastest and most effective security step most small businesses can take. Protect administrators, owners and finance first with the strongest method you can, use an authenticator app with number matching for everyone else, avoid text messages as the main factor, close the side doors, write down how lost phones are handled and teach people to refuse prompts they did not start. Do that and the single most common way into your business stops working.

If you would like help rolling it out, contact IT-Support-SA or WhatsApp us.

Multi-Factor Authentication for Small Businesses in South Africa: Which Method and How to Roll It Out