Defend Your Data: Lock down accounts with extra layer of security | E-News

As part of Cybersecurity Awareness Month, ITS reminds you that multifactor authentication adds an extra layer of security by requiring two or more forms of identity verification when you log in.

MFA combines something you know, such as a password, with something you have or something you are, such as an authenticator app, verification codes, a security key, or fingerprint or facial recognition scan.

Even if someone gets your password, MFA can help stop them from accessing your account.

ITS encourages all employees and students to enable MFA on their personal accounts wherever it is available.

If a service offers passkeys, consider using them. They are designed to be resistant to phishing and can replace passwords on supported services.

Not all MFA methods provide the same level of protection. When available, passkeys, hardware security keys, and authenticator apps offer stronger protection than SMS or email codes. WVU uses Okta Verify, but other trusted MFA apps include Microsoft Authenticator and Google Authenticator.

Cybercriminals may try to bypass MFA using tactics such as:

Phishing: Tricking you into entering both your password and MFA code on a fake website or into giving a code to a scammer.

Phishing: Tricking you into entering both your password and MFA code on a fake website or into giving a code to a scammer.

MFA fatigue: Flooding you with login approval requests until you accidentally approve one.

MFA fatigue: Flooding you with login approval requests until you accidentally approve one.

SIM swapping: Taking control of your phone number to intercept text-based authentication codes.

SIM swapping: Taking control of your phone number to intercept text-based authentication codes.

If you receive an unexpected MFA prompt, do not approve it. If you think someone may have your password, change it immediately and review your account for unauthorized activity.