Dealing with Cyber Threats: The Evolution of Multi-Factor Authentication

As the cyber threat landscape continues to evolve, you may have been advised by some of your service providers to use Multi-Factor Authentication (MFA) to safeguard your accounts.

While MFA sounds complicated, the concept behind it is simple. MFA basically means using two or more ways to confirm your identity instead of relying on a single method.

Why is this so important? Employing multiple verification methods helps harden your defenses and keep hackers out.

We’ve provided some background information about MFA to help you better understand it, and hopefully feel more comfortable using it.

How MFA Evolved to Improve Security

Over the years, cybercriminals have become more sophisticated and better at taking over accounts.  To counteract this, authentication methods used to identify account holders also needed to evolve.

Authentication started by relying on something you know to confirm your identity, such as usernames, passwords or answers to common security questions (like your mother’s maiden name or the make and model of your first car).

The problem with this approach? Individuals tend to reuse the same usernames, passwords or security answers for each of their accounts. So, if a cybercriminal determined this information for your email account, for example, they could use it in a domino effect to gain access to your financial, social media and other sensitive accounts.

Additionally, cyber breaches of major organizations exposed enormous volumes of personal information, allowing thieves to hit the data lottery. In this scenario, fraudsters have access to millions of records containing personal information, passwords, answers to your security questions, and much more.

As a result, many institutions concluded this “knowledge-based” authentication approach was no longer sufficient to prevent fraud. They began to include an additional verification requirement – “something you have” or physically possess – such as your smart phone or another trusted device.

The drawback to this method? What happens if you lose that device? Or if a security code sent to your phone was intercepted by a cybercriminal in a phone porting or SIM card swapping attack?

That led to the third authentication factor – “something that you are” – such as unique human features like your fingerprints, eyes, face or voice. With this biometric approach, instead of typing in your password, you just hold up your phone to scan your face.

The Latest Advancements in MFA

For even stronger account protection, we offer two advanced forms of MFA:  authenticator apps and security keys.

An authenticator app is a third-party application that verifies your identity when you log in to access your accounts on Morgan Stanley Online or our Mobile App. It’s a fast, simple process. When prompted to confirm your identity, you’ll open your authenticator app and retrieve a security code. You’ll then enter the code and click “Authorize” to verify your session. Authenticator apps offer added protection against SIM-swapping attacks and work even without cell service and when traveling internationally. Do your research before the selecting the authenticator app that’s right for you and then download it from your device’s app store.

A security key is a small device that resembles a USB thumb drive. Security keys are considered the strongest form of “something-you-have” MFA currently available to consumers.

The same key can safeguard your email, social media, banking and other accounts as long as those account providers are compatible. So, you won’t need a separate key for each account.

Using a security key for your sensitive logins will also grant you greater protection from internet scams, such as fake sites implemented by cybercriminals to steal your login information. These phony sites often look so identical to the real site that it’s difficult for unsuspecting users to notice the difference.

Keeping Your Accounts Secure

When it comes to account security, there’s strength in numbers. Make sure to use a layered approach that relies on multiple ways to confirm your identity.

Another way to protect yourself or your loved ones’ accounts from fraud and financial scams is to add a trusted contact. A trusted contact is a person you designate to be contacted if we are unable to reach you or if there are concerns regarding your well-being or potential financial exploitation. It is important to note that a trusted contact does not have permission to access account details, make decisions or perform any actions on your behalf. This individual serves as an additional layer of defense in case issues arise.