Passwords alone are no longer enough. Stolen, guessed, or reused passwords are behind a large share of breaches. Multi-factor authentication (MFA) adds a second proof of identity, and it blocks the vast majority of automated account attacks.

But not all MFA methods are equally strong. Here they are, from weakest to strongest.

1. SMS text message codes

Better than nothing, but the weakest option.

Codes sent by text can be intercepted through SIM swapping or phishing. Still, SMS is far safer than no MFA at all, and it may be a reasonable starting point for less critical accounts.

2. Email codes

Convenient, but only as secure as the email account.

If an attacker already controls the mailbox, they can read the code. Use this only where nothing stronger is available.

3. Authenticator app codes (TOTP)

A solid, widely supported choice.

Apps like Microsoft Authenticator or Google Authenticator generate time-based codes on your phone. They are not tied to your phone number, so SIM swapping doesn’t affect them. They can still be phished if a user types the code into a fake site.

4. Push notifications with number matching

Strong and user-friendly.

You approve a sign-in on your phone, and you must enter a number shown on the login screen. That number matching defeats “MFA fatigue” attacks, where criminals spam approval requests hoping someone taps *Approve* by mistake.

Avoid simple push approvals without number matching.

5. Hardware security keys and passkeys (FIDO2)

The strongest option available.

Physical keys (like YubiKey) and passkeys built into modern devices use cryptography that verifies the website you are logging in to. If you land on a fake site, the login simply fails. This makes them highly resistant to phishing.

Quick comparison

Method	Security	Convenience	Phishing resistant
SMS code	Low	High	No
Email code	Low	High	No
Authenticator app	Medium-High	Medium	No
Push with number matching	High	High	Partly
Security key / passkey	Very high	Medium-High	Yes

Practical recommendations

– Turn on MFA everywhere, starting with email, Microsoft 365, banking, and administrator accounts.

– Use authenticator apps or number-matched push as your standard for all staff.

– Require security keys or passkeys for administrators and high-risk roles.

– Disable SMS and email codes where stronger options are available.

– Combine MFA with Conditional Access so risky logins get extra scrutiny.

Don’t forget the human side

Even the best MFA fails if users approve prompts they didn’t initiate. Train your team: if you didn’t just try to log in, deny the request and report it.

DBR Soft helps businesses roll out MFA, Conditional Access, and passkeys with minimal disruption. Contact us to strengthen your sign-in security.