Multi-Factor Authentication — What to Know

Nearly half of all US adults had their personal information compromised in just two years, 2013 and 2014. During those years, a single attack against Target^® stores stole more than 40 million credit and debit card numbers. Yahoo!^® customers fared even worse: 3 billion accounts were hacked. Even with tighter cybersecurity efforts, still hardly a week goes by without come news of cyber fraud. Last year, the number of data breaches exceeded 6,500. Consumers must take steps to help protect their personal information, and that’s where multi-factor authentication comes in (also referred to as two-step or two-factor authentication).

What Is Multi-Factor Authentication?
Multifactor authentication (MFA) is a security system that requires more than one method of authentication from independent categories of credentials to verify the user’s identity for a login or other transaction. Multifactor authentication combines two or more independent credentials: What the user knows (a password), what the user has (a security token) and what the user is (biometric verification).

When you log in to a site that has MFA, you are asked to verify your identify by both knowing something and having something. First, you need to know your user name and password. That’s the traditional single-factor authentication. A second step requires that you verify your identity with a mobile phone, or other device, that can receive a one-time access code.

Once you have entered your user name and password, the site texts a code to the mobile phone or other device you have designated to receive them. Account access is enabled only after you add that code to your login screen. The code usually is active only for a short period of time. If you don’t use the code within that time period, you’ll need to request another code.

Why Is MFA Important?
MFA is particularly important on any sites or services wherein personal sensitive information is stored. Think about where you store your photos and personal financial records. Consider your online banking accounts, your email accounts, and contact lists. This kind of information is indeed worthy of extra protection.

Once you set up MFA and use it on a site, you don’t typically need to perform the second step again. However, some sites require you to do so after a certain period of time (for example, if you haven’t logged in for 30 days or more). Some sites even allow you to specify that time period yourself. 

While multi-factor authentication does add a bit more work when it comes to logging in, the extra protection is worth it if it prevents a hacker’s access.

Take Steps to Protect Yourself
UFCU takes fraud protection seriously and offers MFA on all accounts. We encourage Members to take advantage of our multi-factor authentication as an additional way to protect yourself from fraud and identity theft.