Multi-Factor Authentication for Small Business: Which Type to Use, and Why SMS Isn't Enough

Most small businesses can say "we have MFA on" and mean it, because some app somewhere is asking for a second code. What that sentence hides is which type of MFA got turned on, and the type an employee lands on during a five-minute setup screen is usually whichever one required the least effort, which also happens to be the weakest one available. Not every second factor makes an account meaningfully harder to break into, and attackers have adapted specifically to the weak ones.

The MFA hierarchy, from weakest to strongest

Every MFA method proves you have something beyond a password, but they don't all prove it the same way, and that difference is exactly where attackers operate:

• SMS and voice codes. The weakest common option. Codes travel over the phone network and depend on your mobile carrier account staying secure, not just your device.
• Authenticator app codes (TOTP). Better, since the code is generated on-device and doesn't depend on a phone number. Still vulnerable if an employee reads the code to someone over the phone or pastes it into a fake login page.
• Push notifications. Convenient, but without number matching enabled, they're the exact mechanism behind fatigue attacks: an attacker with a stolen password sends repeated approval prompts until someone taps "yes" just to make the notifications stop, covered in our MFA fatigue post.
• Hardware security keys and passkeys. The strongest option available today. The authentication is bound to the real website's address, so a fake login page can't complete it even if an employee gets fooled into visiting one, detailed in our passkeys post.

Why SMS keeps showing up as the default anyway

If SMS is the weakest option, it's worth asking why it's still the first thing most services offer. The answer is that it requires nothing new: no app to install, no key to buy, just a phone number the service already has. That convenience is precisely what makes it attractive to attackers too. SIM swapping lets someone port a victim's phone number to a device they control by social-engineering a mobile carrier, and once that's done, every SMS code meant for that number arrives on the attacker's phone instead, a scenario we cover in detail in our SIM swapping post. SMS also offers zero protection against a real-time phishing page that captures a code and relays it to the real login instantly, the same class of attack behind session hijacking. None of that requires sophisticated tooling; it requires the account to still be using SMS by default.

Matching the MFA type to the account

A small business doesn't need every account on a hardware key, and it shouldn't leave every account on SMS either. The practical middle ground is matching the method to what the account can do if it's compromised:

• Admin, financial, and domain-registrar accounts (Microsoft 365 global admin, banking, your DNS provider) should move to hardware keys or passkeys first. These are the accounts where a breach isn't an inconvenience, it's the whole business.
• General staff accounts are well served by an authenticator app, standardized across the team so support isn't fielding five different apps.
• Push notifications should have number matching turned on wherever they're used, closing the fatigue-attack gap without giving up the convenience.
• SMS should be a fallback recovery option, not the primary method, on any account where an alternative exists.

Rolling it out without breaking the office

The rollout that actually sticks starts narrow and expands. Enable stronger MFA on the handful of admin and financial accounts first, since that's where the risk is concentrated and the user count is small enough to walk through personally. Standardize on one authenticator app for everyone else rather than letting each employee choose their own, which keeps support requests predictable. Generate and store recovery codes somewhere other than the device the MFA app lives on, so a lost phone doesn't turn into a lockout. And don't forget the accounts that don't feel like "real" logins: shared mailboxes, the point-of-sale system, and the printer's admin panel are all accounts too, and they're often the ones still running on a password alone.

Where this fits

• The MFA fatigue post, for the attack that specifically targets push-based MFA.
• The passkeys post, for a rollout plan for the strongest available option.
• The password managers post, for the first layer MFA sits on top of.
• The SIM swapping post, for why SMS-based codes specifically fail.
• The identity hardening post, for the broader Microsoft 365 identity checklist MFA is one piece of.

We roll this out for clients across Salinas, Monterey, Santa Cruz, Watsonville, and San Jose, starting with the admin accounts that actually carry the risk.

FAQs about multi-factor authentication for small business

What's the strongest type of MFA for a small business?

Hardware security keys and passkeys are the strongest option because they're phishing-resistant by design; a fake login page simply can't complete the authentication handshake. Authenticator apps with number matching are a solid second choice. SMS and voice codes are the weakest and should be a fallback, not the default.

Why is SMS-based MFA considered risky?

SMS codes travel over the phone network and depend on the security of your carrier account, not just your device. SIM swapping lets an attacker port your number to a phone they control and receive the codes directly, and SMS offers no protection at all against a phishing page that relays the code in real time.

Does MFA replace the need for strong passwords or a password manager?

No. MFA is a second layer, not a replacement for the first. A weak or reused password is still the easiest way into an account that has MFA enabled but not enforced everywhere, and a password manager remains the fastest way to eliminate reused passwords across a team.