Multi-Factor Authentication

Multi-factor authentication, commonly abbreviated MFA, works on a simple principle: even if an attacker steals a password, they still cannot log in without a second proof of identity. That second factor is typically a time-sensitive code delivered to a mobile device, generated by an authenticator app, or embedded in a hardware security key. Each layer meaningfully raises the cost and complexity of unauthorized access.

For a family office, MFA is widely considered non-negotiable on any account that touches money or sensitive data — banking portals, investment platforms, email, document vaults, and payroll systems. A hypothetical three-generation family office managing multiple entities might have dozens of staff and advisors accessing financial systems; a single compromised password without MFA could expose the entire infrastructure.

Not all MFA is equally strong. SMS text-message codes are convenient but can be intercepted through a technique called SIM swapping, where an attacker convinces a mobile carrier to redirect a phone number. Authenticator apps and hardware keys — small physical devices that plug into a computer — are generally considered more resistant. Families typically work with their IT advisors to match the MFA method to the sensitivity of each system.

MFA is a foundational control that cyber insurance underwriters now commonly require before issuing or renewing a policy. It also reduces the blast radius when a phishing attack succeeds in capturing a credential, and it appears in most incident response checklists as a first-line containment step.