Enabling multi-factor authentication is usually treated as a binary. It is not: the methods differ substantially in what they defend against, and the gap becomes decisive against the phishing kits in common use today.
SMS codes — weakest, still better than nothing
Vulnerable to SIM swap, to interception, and to real-time relay through a proxy phishing page. Use it where nothing else is offered, and prioritise moving banking, email, and any crypto exchange account off it.
Authenticator app codes — a meaningful improvement
Time-based codes remove SIM swap exposure entirely and are widely supported. They remain phishable in real time: a proxy page asks for the code and relays it to the real service within its validity window. Good general-purpose protection, not sufficient alone for your highest-value accounts.
Push approval — convenient, with a specific weakness
A simple approve/deny prompt is vulnerable to fatigue attacks, where an attacker with your password triggers prompts repeatedly until someone approves to stop the noise. Number matching, where you enter a digit shown on the login screen, substantially mitigates this. Enable it if your provider offers it.
Passkeys — the practical answer for most people
A passkey is cryptographically bound to the site it was created for. A lookalike domain cannot use it, because the browser will not offer it there. This defeats real-time phishing structurally rather than by vigilance. Support is now broad across major platforms, and the user experience is usually faster than typing a code.
Hardware security keys — strongest
A physical key providing the same phishing resistance with the credential held on separate hardware. Appropriate for administrators, finance staff, and anyone holding significant digital assets. Issue two per person — one carried, one stored securely — so a lost key is an inconvenience rather than a lockout.
Where to spend the effort
Protect email first, because it is the reset path for everything else, then administrative consoles, then finance and banking. Enabling the strongest available method on those three categories delivers more protection than uniform mediocre coverage everywhere.
Plan recovery before enrolment
Register at least two factors per account, store recovery codes somewhere genuinely separate from your password manager, and document an administrator-assisted recovery process with identity verification. Lockouts drive emergency exceptions, and exceptions quietly become the new normal.