{"id":8149,"date":"2026-09-28T06:45:00","date_gmt":"2026-09-28T10:45:00","guid":{"rendered":"https:\/\/verito.com\/blog\/?p=8149"},"modified":"2026-10-12T12:52:44","modified_gmt":"2026-10-12T16:52:44","slug":"what-actually-counts-as-mfa","status":"publish","type":"post","link":"https:\/\/verito.com\/blog\/what-actually-counts-as-mfa\/","title":{"rendered":"MFA for Tax Firms: Choosing Phishing-Resistant Authentication"},"content":{"rendered":"\n<p><strong>Multi-factor authentication requires different types of authentication factors. A password followed by another password is not MFA. For tax firms, the next question is whether the chosen method can resist a fake sign-in page that relays the user&#8217;s credentials.<\/strong><\/p>\n\n\n\n<p>Email, remote access, administrator accounts, and tax applications can expose different risks. Build an account inventory before assuming that an authenticator on one system protects the entire firm.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<h2 class=\"wp-block-heading\" id=\"key-takeaways\">Key takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>MFA uses different factor types; two passwords do not provide two factors.<\/li>\n\n\n\n<li>A code or push prompt can add protection while remaining vulnerable to phishing.<\/li>\n\n\n\n<li>Prefer supported phishing-resistant methods for email, administrator and remote-access accounts.<\/li>\n\n\n\n<li>Test enrollment, recovery and offboarding so a weaker fallback does not undermine the rollout.<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2 id=\"table-of-contents\">Table of Contents<\/h2><nav><ul><li><a href=\"#key-takeaways\">Key takeaways<\/a><\/li><li><a href=\"#what-actually-counts-as-an-authentication-factor\">What actually counts as an authentication factor?<\/a><\/li><li><a href=\"#which-mfa-methods-resist-phishing\">Which MFA methods resist phishing?<\/a><\/li><li><a href=\"#how-should-a-firm-compare-the-authentication-methods\">How should a firm compare the authentication methods?<\/a><\/li><li><a href=\"#which-accounts-should-a-tax-firm-address-first\">Which accounts should a tax firm address first?<\/a><\/li><li><a href=\"#how-do-you-introduce-stronger-mfa-without-locking-out-the-team\">How do you introduce stronger MFA without locking out the team?<\/a><\/li><li><a href=\"#what-should-an-account-recovery-process-include\">What should an account recovery process include?<\/a><\/li><li><a href=\"#what-if-someone-enters-a-code-on-a-phishing-page\">What if someone enters a code on a phishing page?<\/a><\/li><li><a href=\"#how-verito-helps-strengthen-account-protection\">How Verito helps strengthen account protection<\/a><\/li><li><a href=\"#sources\">Sources<\/a><\/li><\/ul><\/nav><\/div>\n\n\n\n<ul class=\"wp-block-list\"><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-actually-counts-as-an-authentication-factor\">What actually counts as an authentication factor?<\/h2>\n\n\n\n<p>Authentication factors fall into three broad groups: something you know, something you have, and something you are. A password is something you know. A properly configured authenticator or security device can provide a possession factor. A biometric can be used within an authentication process.<\/p>\n\n\n\n<p>The label \u201ctwo-step verification\u201d describes a sequence, but it does not prove that two different factor types are involved. Two knowledge questions remain one factor type.<\/p>\n\n\n\n<p>For covered firms, the <a href=\"https:\/\/www.ecfr.gov\/current\/title-16\/chapter-I\/subchapter-C\/part-314\/section-314.4\" target=\"_blank\" rel=\"nofollow noopener\">FTC Safeguards Rule<\/a> addresses MFA for people accessing information systems. An alternative requires the Qualified Individual&#8217;s written approval of reasonably equivalent or stronger controls. Choosing a method should consider both the requirement and the actual threat.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-sim-swap-1024x576.jpg\" alt=\"SIM swap redirecting mobile codes cinematic visual | Verito\" class=\"wp-image-8162\" srcset=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-sim-swap-1024x576.jpg 1024w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-sim-swap-300x169.jpg 300w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-sim-swap-768x432.jpg 768w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-sim-swap-1536x864.jpg 1536w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-sim-swap-380x214.jpg 380w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-sim-swap-800x450.jpg 800w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-sim-swap-1160x653.jpg 1160w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-sim-swap-150x84.jpg 150w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-sim-swap.jpg 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"which-mfa-methods-resist-phishing\">Which MFA methods resist phishing?<\/h2>\n\n\n\n<p>Text-message codes, authenticator codes, and ordinary approval prompts can improve security compared with a password alone. They are still vulnerable to certain attacks, including fake sign-in pages that relay a code or requests that pressure a user into approving an unexpected login.<\/p>\n\n\n\n<p><a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/publications\/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf\" target=\"_blank\" rel=\"nofollow noopener\">CISA&#8217;s phishing-resistant MFA guidance<\/a> identifies FIDO\/WebAuthn and appropriately implemented public-key authentication as stronger approaches against these credential-phishing paths. Authentication is bound to the legitimate service rather than depending on a user recognizing every imitation.<\/p>\n\n\n\n<p>A security key or passkey deployment should be configured and tested for the intended assurance. Do not assume every feature called a passkey automatically provides the same combination of factors, user verification, recovery, and administrative control.<\/p>\n\n\n\n<p>This also does not eliminate malware, stolen sessions, or a compromised endpoint. Authentication belongs alongside device protection, account monitoring, and staff training.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-should-a-firm-compare-the-authentication-methods\">How should a firm compare the authentication methods?<\/h2>\n\n\n\n<p>Compare what staff actually do at sign-in. SMS and authenticator-app codes require a user to enter a code; an imitation sign-in page may relay that code to the real service. A simple approve-or-deny push prompt can also be abused by repeatedly prompting a distracted user.<\/p>\n\n\n\n<p>Number matching can reduce accidental push approvals, but it should not be treated as equivalent to phishing-resistant authentication. CISA recommends it as an interim mitigation when a firm cannot yet implement a phishing-resistant method.<\/p>\n\n\n\n<p>For systems supporting FIDO2 or WebAuthn, evaluate a security key or a suitable passkey configuration. Test the complete sign-in and recovery path with IT, including user verification and any permitted fallback. The method&#8217;s name alone does not establish that the firm&#8217;s deployment meets its needs.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"which-accounts-should-a-tax-firm-address-first\">Which accounts should a tax firm address first?<\/h2>\n\n\n\n<p>Prioritize accounts that can unlock many other systems or large volumes of information:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firm email and identity-provider administrator accounts.<\/li>\n\n\n\n<li>Remote desktop, VPN, and hosted application access.<\/li>\n\n\n\n<li>Tax software, e-filing, document storage, and client portals.<\/li>\n\n\n\n<li>Backup consoles and security-management tools.<\/li>\n\n\n\n<li>Password managers and accounts used by external IT providers.<\/li>\n<\/ul>\n\n\n\n<p>List the current method, account owner, administrator, fallback method, and application limitations. Shared logins make accountability and offboarding harder; move to individual accounts where the application permits.<\/p>\n\n\n\n<p>Some applications may not support the preferred method directly. Record the limitation and assess compensating controls with the security lead rather than leaving the exception undocumented.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-do-you-introduce-stronger-mfa-without-locking-out-the-team\">How do you introduce stronger MFA without locking out the team?<\/h2>\n\n\n\n<p>Start with a small pilot covering an administrator and ordinary users with different devices. Test real workflows: home access, printing, software updates, portal sign-ins, and a replacement computer.<\/p>\n\n\n\n<p>Check whether staff need a company-issued security key, a managed device, or an approved mobile authenticator. Explain exactly what an expected sign-in looks like and where staff should report an unexpected prompt.<\/p>\n\n\n\n<p>After the pilot, enroll accounts in a planned sequence and remove weaker fallback routes where feasible. A strong primary method can be undermined by a helpdesk reset or recovery option that an attacker can abuse.<\/p>\n\n\n\n<p>Give a named owner responsibility for tracking completion. \u201cWe enabled MFA\u201d should mean the relevant users and access routes are covered, including administrators and service-provider accounts.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-should-an-account-recovery-process-include\">What should an account recovery process include?<\/h2>\n\n\n\n<p>A lost phone or key should trigger a verified recovery process, not an improvised approval over email.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Verify the user&#8217;s identity through an established method independent of the affected account.<\/li>\n\n\n\n<li>Revoke the lost authenticator and review recent access when appropriate.<\/li>\n\n\n\n<li>Enroll a replacement using the approved procedure.<\/li>\n\n\n\n<li>Protect backup codes and spare keys according to the firm&#8217;s access policy.<\/li>\n\n\n\n<li>Record the change and confirm that old access no longer works.<\/li>\n<\/ul>\n\n\n\n<p>Avoid storing every employee&#8217;s recovery information in a shared spreadsheet. Limit access to recovery material and test that authorized staff can use it when the usual administrator is unavailable.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-phishing-resistant-1024x576.jpg\" alt=\"Hardware security key stopping phishing relay cinematic visual | Verito\" class=\"wp-image-8163\" srcset=\"https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-phishing-resistant-1024x576.jpg 1024w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-phishing-resistant-300x169.jpg 300w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-phishing-resistant-768x432.jpg 768w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-phishing-resistant-1536x864.jpg 1536w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-phishing-resistant-380x214.jpg 380w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-phishing-resistant-800x450.jpg 800w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-phishing-resistant-1160x653.jpg 1160w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-phishing-resistant-150x84.jpg 150w, https:\/\/verito.com\/blog\/wp-content\/uploads\/2026\/09\/what-actually-counts-as-mfa-phishing-resistant.jpg 1920w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-if-someone-enters-a-code-on-a-phishing-page\">What if someone enters a code on a phishing page?<\/h2>\n\n\n\n<p>Treat the incident as a possible account compromise. Contact IT through a trusted channel and preserve the message and relevant details.<\/p>\n\n\n\n<p>The response may include revoking active sessions, resetting credentials from a clean device, reviewing mailbox rules, checking account changes, and investigating related access. A password reset alone may leave an attacker with an active session.<\/p>\n\n\n\n<p>Use the <a href=\"https:\/\/verito.com\/blog\/2026-efin-eservices-phishing-scams\/\" target=\"_blank\" rel=\"dofollow\">EFIN phishing response checklist<\/a> to connect authentication choices with the scams tax staff actually encounter.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-verito-helps-strengthen-account-protection\">How Verito helps strengthen account protection<\/h2>\n\n\n\n<p><a href=\"https:\/\/verito.com\/cybersecurity-for-accounting-firms\/\" target=\"_blank\" rel=\"dofollow\">Verito cybersecurity services for accounting firms<\/a> combine relevant device, email, and staff security services. Discuss the systems in your account inventory, which methods each supports, and who owns enrollment and recovery.<\/p>\n\n\n\n<p>Ask for a documented scope. Hosted access, local laptops, email, and third-party tax portals may have different administrators and configuration responsibilities.<\/p>\n\n\n\n<p>For the wider security-program context, read <a href=\"https:\/\/verito.com\/ftc-safeguards-rule\/\" target=\"_blank\" rel=\"dofollow\">Verito&#8217;s FTC Safeguards Rule guide<\/a> alongside the official FTC guidance in Sources.<\/p>\n\n\n\n<p>For firms using Microsoft 365, Verito&#8217;s <a href=\"https:\/\/verito.com\/managed-microsoft-365\/\" target=\"_blank\" rel=\"dofollow\">managed Microsoft 365 service<\/a> addresses MFA, access policies and account onboarding or offboarding. Ask Verito to review the current tenant, supported authentication options and recovery responsibilities before agreeing the rollout.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"sources\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/publications\/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf\" target=\"_blank\" rel=\"nofollow noopener\">CISA: Implementing phishing-resistant MFA<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.ecfr.gov\/current\/title-16\/chapter-I\/subchapter-C\/part-314\/section-314.4\" target=\"_blank\" rel=\"nofollow noopener\">16 CFR 314.4: Safeguards Rule elements<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.ftc.gov\/business-guidance\/resources\/ftc-safeguards-rule-what-your-business-needs-know\" target=\"_blank\" rel=\"nofollow noopener\">FTC: Safeguards Rule business guidance<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2022\/10\/31\/cisa-releases-guidance-phishing-resistant-and-numbers-matching-multifactor-authentication\" target=\"_blank\" rel=\"nofollow noopener\">CISA: Number matching as an interim MFA mitigation<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"Multi-factor authentication requires different types of authentication factors. A password followed by another password is not MFA. For&hellip;\n","protected":false},"author":12,"featured_media":8161,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":{"0":"post-8149","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-knowledge-base"},"acf":[],"_links":{"self":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/comments?post=8149"}],"version-history":[{"count":5,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8149\/revisions"}],"predecessor-version":[{"id":8467,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/posts\/8149\/revisions\/8467"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/media\/8161"}],"wp:attachment":[{"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/media?parent=8149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/categories?post=8149"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/verito.com\/blog\/wp-json\/wp\/v2\/tags?post=8149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}