SecurityWise: Multi-factor authentication for online services

16 Feb 2024

Multi-factor authentication (MFA) is a security measure that requires users to provide two or more different factors to verify their identity when logging in to an online account and to protect against password guessing. This makes it much more difficult for attackers to gain unauthorised access, even if they have stolen the user's password. MFA can also be called 2-step verification (2SV) or two-factor authentication (2FA).

Neglecting security measures on your jewellery website could leave your business exposed to vulnerabilities, so it’s important to think about security so that your site, your customers, and its content are protected against malicious attacks. As technology grows and customers look to shop more online for their jewellery pieces and hackers increasingly use sophisticated techniques to obtain details, you must consider the use of extra layers of website and transaction security to protect your customers information.

There are three main common types of MFA factors:

• Something you know: This could be a password, PIN, or other secret code that only the user knows.
• Something you have: This could be a smartphone, physical security key, or other device that is in the user's possession.
• Something you are: This could be a biometric factor such as a fingerprint, facial scan, or voiceprint.

Online shopping fraud is on the rise and data breaches play a large factor in assisting online fraudsters, as stolen personal information is one of the most common ways for scammers to access victim accounts. Account takeover has replaced stolen financials as the fastest-growing fraud threat for e-commerce websites. Ultimately, more and more e-commerce stores are unfortunately forced to deal with fraudulent purchases.

In an effort to maximise sales volume, e-commerce retailers can be hesitant to add additional steps to check out in fear of customers clicking away in the middle of a purchase, but MFA is one of the most accessible ways to authenticate transactions and help deal with these fraudulent purchases. 

MFA can be implemented in a variety of ways, but the most common approach is to require users to provide a one-time password (OTP) in addition to their password. OTPs can be generated in a variety of ways, such as through SMS text messages, authenticator apps, or physical security keys.

To enable MFA on an online service, users typically need to go to their account settings and enrol in an MFA factor. Once enrolled, they will be prompted to provide their MFA factor each time they log in. Therefore, MFA is a highly effective way to protect online accounts from unauthorised access. It is recommended that businesses enable MFA on all their important customer online accounts.

Here are some tips for implementing and using MFA effectively:

• Choose a strong MFA factor. Authenticator apps and physical security keys are generally more secure than SMS text messages.
• Enrol in multiple MFA factors. This will give customers backup in case they lose access to one of these factors.
• Keep your MFA factors secure and keep your cloud-based services and apps up to date.

MFA provides a simple and effective way to protect online accounts, being an accessible but powerful tool that not only authenticates transactions but also helps to discourage hackers and scammers since they can easily target a weaker platform or online store instead. As a security tool that benefits both consumers and businesses, it should be considered just as seriously in e-commerce as you would do in other personal accounts. By following these tips, you can make it much more difficult for attackers to gain unauthorised access making fraudulent purchases.

Source: SecurityWise