Multi-factor authentication, or MFA, requires more than one type of evidence to verify identity. NIST describes factors such as knowledge, possession and a personal characteristic. Two passwords are still the same type of factor. Source: NIST: multi-factor authentication

Apply it to the accounts that run the business

List the email, booking, payment and website accounts your team uses. Record which verification methods each service supports and who owns its recovery process. This gives you a practical rollout list without assuming every supplier offers the same controls.

Choose the method and recovery route together

The NCSC distinguishes several MFA approaches and describes FIDO2 as a phishing-resistant option when it is supported and correctly configured. Do not treat every method as providing identical protection. Source: NCSC: recommended types of multi-factor authentication

Test an agreed recovery procedure with the account owner before relying on it. Keep recovery material in an approved secure location, so a lost device does not leave the business dependent on an improvised password reset. The NCSC specifically advises keeping backup codes safe. Source: NCSC: setting up 2-step verification

Written and updated by Travelgenix. Sources checked on 16 October 2026. Worked examples and checklists are editorial illustrations and recommendations, not customer results.