If you've never been hacked, it might seem unnecessary to set up extra security on your online accounts. You already have strong passwords - you definitely don't use P@ssword123 - and might think that's enough. But your personal information is in fact still at risk.
With cybercrime increasing rapidly every year, experts say you need to add an extra layer of security to your online accounts by incorporating two-factor authentication (2FA).
"Two-factor authentication is when an additional layer - or factor - of logins is added to your account," explains Professor Elmarie Biermann, director of the Cyber Security Institute.
With this method the user needs a login and password, but also, for example, a one-time PIN (OTP) sent to a mobile number, she says.
"It's like having a key to unlock a door," explains Craig Rosewarne, managing director of online security company, Wolpack Information Risk.
"But even if someone steals your key, they can't enter your property because there's a security guard asking to see their ID to prove they are who they claim to be."
Here's what you need to know about 2FA.
How can it help me?
Two-factor authentication makes it much harder for hackers to gain access to your apps or devices, says Toni Bowker, managing director at Cyber Security South Africa.
"If they don't have the secondary authentication method, they can't gain access to what they want," Bowker says.
If your username or password to an account is compromised in a cyberattack on an organisation or business, cybercriminals will be able to access your accounts, warns Rosewarne.
Your credentials could also be compromised if you click on links in phishing emails or inadvertently share your username and password with hackers. "But two-factor authentication will challenge the cybercriminals, as they will need to provide an additional level of identification. It's an extra level of security, which is very much required nowadays," he adds.
'Cybercrime is not going to fade away. It is ever increasing'
Passwords as the only authentication method can be problematic, Biermann says, because people tend to use the same passwords for different sites or choose passwords that are easy to remember, like 123456.
This makes it easy for cybercriminals to guess passwords and gain access to your accounts.
"By adding another layer to confirm a login, it adds a level of security to protect the consumer," she says.
Is it reliable?
It's reliable and it's secure, especially when it's used correctly, experts say.
Bowker believes it's a deterrent to attackers as they tend to avoid trying to hack devices that have multi-factor authentication enabled, as it is much harder to gain access.
While 2FA is highly reliable, Biermann warns people to be aware of the methods used by cybercriminals and "not to share their OTPs as it will make the added security layer useless".
Cybercriminals' methods are ever-changing, she says.
"People need to be aware of the dangers in cyberspace and they have to take responsibility to protect their information, data and money.
"Cybercrime is not going to fade away; it is ever increasing and all of us need to do our bit to stay safe."
How to turn on 2FA on Facebook
- Go to Settings and Privacy, then click on Settings, then Security and login.
- Scroll down to Use two-factor authentication and click Edit.
- Choose the security method you want to add and follow the on-screen instructions.
- You'll be asked to choose one of three security methods to use going forward: tapping your security key on a compatible device, using login codes from a third-party authentication app or via a text message (SMS) code from your cellphone.
Who should use it?
Everyone should be using 2FA, Rosewarne says.
"Think about all your social media apps, things like Facebook, WhatsApp, Instagram, etc.
"We've seen several compromises where criminals are easily able to trick people and get their username and passwords and log in to their accounts. Once they login as you, they will lock you out of the account.
"They will try to scam people who are following you. Your friends and family will believe it because they think it's you and they trust you."
Apart from social media, cloud platforms like Microsoft, Google, OneDrive and iCloud should all be protected by using 2FA.
Basically, anything sensitive should be protected, Rosewarne says.
2FA apps
These are some of the free apps you can download from your app store to beef up your online security.
Authy
Authy can be used on any device, including desktops and fitness watches.
It allows you to manage security keys and control the devices that use them.
It also allows you to access secure websites when you don't have internet access on your phone.
The app provides options including TouchID, PIN protection and passwords, so access to your security keys are also secured.
Google Authenticator
This app can also be used in non-Google browsers like Safari and Mozilla Firefox.
It generates two-factor authentication codes in your browser and allows you to add devices by scanning QR codes.
The app also allows you to back-up your sensitive information to your Google Drive, Microsoft OneDrive or Dropbox.
Microsoft Authenticator
You can use this app to sign into your Microsoft account - and non-MS accounts - without a password, and rather with a fingerprint, face recognition or a PIN.
You can use it to sign in even if you've forgotten your password.
It can be used to back-up and restore all your other account credentials if necessary.
What are the different 2FA methods?
One of the traditional forms of 2FA is an OTP that is sent via SMS or email - banks have used this method for several years. Another method is physical security keys, which look like flash sticks, which must be plugged into a USB port on your computer before you can access certain app.
Then there's voice-based authentication - voice recognition technology which confirms your identity. Another method used by banks lately, an alternative to an SMS with an OTP, is a message from your banking app asking if you agree to the transaction. You then need to log in to your banking app and give the go-ahead for the transaction.
EXTRA SOURCES: MICROSOFT.COM, AUTHY.COM, CHROME.GOOGLE.COM, FACEBOOK.COM
