If your business still relies on passwords alone, you're leaving the front door unlocked. IBM's 2025 Cost of a Data Breach Report puts the average breach cost for South African organisations at R44.1 million, and small businesses are disproportionately targeted. The fix isn't complicated or expensive. It starts with multi-factor authentication (MFA).
What Is Multi-Factor Authentication (Plain English)
MFA adds a second check when you log in. Instead of just typing a password, you also confirm your identity through something else, usually a notification on your phone or a code from an app.
Think of it like a house key plus an alarm code. Even if someone copies your key (steals your password), they still can't get in without the alarm code (your phone).
MFA uses at least two of these three factors:
- Something you know, your password or PIN
- Something you have, your phone, a security key, or an authenticator app
- Something you are, a fingerprint or face scan
According to Microsoft, MFA blocks over 99.9% of automated credential-based attacks, the kind where hackers use stolen password lists to try thousands of logins. That's not a marginal improvement. It's a near-complete shutdown of the most common attack method.
Why SA Businesses Are at Extra Risk
South Africa consistently ranks among the most-targeted countries for cybercrime. The South African Banking Risk Information Centre (SABRIC) reported that digital banking fraud surged by 86% in their 2024 annual report, with small and medium businesses bearing the brunt.
The most common attacks against SMBs follow a predictable pattern: criminals buy leaked password lists from data breaches, then use automated tools to try those passwords across thousands of business accounts. If your team reuses passwords (most people do), one breach at a completely unrelated service can hand criminals the keys to your email, cloud storage, and financial systems.
But there's a more specific threat in South Africa that makes MFA even more urgent: SIM-swapping.
The SIM-swap problem
SIM-swap fraud is when a criminal convinces your mobile provider to transfer your phone number to their SIM card. Once they have your number, they receive all your SMS messages, including those one-time codes your bank or email sends for verification.
SIM-swap fraud is a well-documented and growing problem in South Africa. Criminals often use social engineering or bribe insiders at mobile networks to complete the swap. This means SMS-based verification codes aren't safe enough for South African businesses. A text message code is better than nothing, but it's vulnerable to exactly the kind of fraud that's most common here.
The solution: app-based authenticators
Instead of SMS codes, use an authenticator app like Microsoft Authenticator or Google Authenticator. These generate time-based codes directly on your phone, no mobile signal needed, no SMS to intercept. Even if someone SIM-swaps your number, the authenticator app stays on your original device and keeps working.
The setup takes two minutes per person: download the app, scan a QR code on screen, and you're done. From then on, every login shows a push notification or asks for a six-digit code that changes every 30 seconds.
This is important context for that 99.9% statistic: MFA blocks virtually all automated attacks (bots trying stolen passwords). But targeted attacks like SIM-swapping can bypass SMS-based MFA specifically. App-based authenticators close that gap.
MFA and Your POPIA Obligations
South Africa's Protection of Personal Information Act (POPIA) requires every business that processes personal data to take "appropriate, reasonable technical and organisational measures" to protect it (Section 19).
POPIA doesn't name MFA as a specific requirement. But if your business suffers a data breach and you weren't using MFA, a widely available, low-cost security measure, it's hard to argue you took "appropriate, reasonable" steps.
Enabling MFA is one of the simplest ways to demonstrate you're meeting your POPIA obligations. It's not a legal mandate for MFA specifically, but it's a practical step that any regulator would consider reasonable.
Beyond compliance, there's a business reputation argument: if a client's data is exposed because your team wasn't using MFA, explaining "we chose not to enable a free security feature" isn't a conversation any business owner wants to have.
How to Set Up MFA for Your Business (Step by Step)
Microsoft 365 (recommended for most SA small businesses)
If your team uses Microsoft 365, MFA is already included in every business plan, you just need to turn it on.
- Sign in to the Microsoft Entra admin centre at entra.microsoft.com with your admin account
- Browse to Entra ID → Overview → Properties
- Select Manage security defaults and set it to Enabled
- Ask each team member to download Microsoft Authenticator from their app store
- On their next login, they'll be prompted to set up the app. It takes about two minutes per person
That's it. Five steps. No hardware to buy, no consultants needed for a small team.
Tip: If you have a larger team or need more control (like requiring MFA only when staff log in from outside the office), your IT provider can set up Conditional Access policies, these come with Microsoft 365 Business Premium and give you fine-grained control over when MFA kicks in.
Google Workspace
If your business uses Google Workspace instead, the process is similar:
- Open the Admin console at admin.google.com
- Go to Security → Authentication → 2-step verification
- Set enforcement to On for your organisation
- Staff download Google Authenticator and follow the setup prompt on next login
What MFA Costs for a Small Business
Here's what most businesses don't realise: MFA is free on almost every platform you're already paying for.
- Microsoft 365 Business Basic (from R99/user/month). MFA via Security defaults included
- Google Workspace Business Starter. MFA included at no extra cost
- Microsoft Authenticator / Google Authenticator apps, free to download and use
The only cost is time: roughly 10 minutes of admin setup plus 2 minutes per team member to configure their app. For a team of 10, that's about 30 minutes total.
Compare that to the cost of a breach: IBM's 2025 report puts the average at R44.1 million for South African organisations. Even for a small business, a breach means lost clients, legal exposure under POPIA, and weeks of disruption.
How TechCloud Helps SA Businesses Implement MFA
At TechCloud, we help small businesses across South Africa get their security right, without the complexity. As part of our managed IT services, we handle:
- MFA deployment across all your business applications. Microsoft 365, cloud storage, remote access tools
- Authenticator app setup for every team member, with hands-on guidance
- Security reviews to identify gaps beyond just passwords, access controls, sharing permissions, device policies
- Microsoft 365 setup and management. MFA is just one part of a properly configured cloud environment
- Team training so your staff know how to spot phishing emails and why MFA matters
We're cloud-first, no servers to manage, no complex on-site hardware. Our managed IT support plans start from R500/user/month and include ongoing security management as standard.
Frequently Asked Questions
Does POPIA require MFA specifically?
No. POPIA Section 19 requires "appropriate, reasonable technical and organisational measures" to protect personal information, but it doesn't name specific technologies. However, MFA is widely recognised as a baseline security measure. If you experience a breach without it in place, demonstrating that you took "reasonable" steps becomes much harder.
What's the difference between 2FA and MFA?
Two-factor authentication (2FA) uses exactly two verification steps. Multi-factor authentication (MFA) uses two or more. In practice, most small business setups use two factors (password + authenticator app), so the terms are often used interchangeably. The important thing is that you're using more than just a password.
Can MFA be bypassed?
MFA blocks 99.9% of automated credential-based attacks, according to Microsoft's research. However, targeted attacks like SIM-swapping can bypass SMS-based codes specifically, which is why we recommend app-based authenticators like Microsoft Authenticator rather than text message codes. No security measure is 100% perfect, but MFA makes your business dramatically harder to break into.
Which authenticator app should I use?
For Microsoft 365 users, Microsoft Authenticator is the best choice, it integrates directly and supports passwordless sign-in. For Google Workspace, use Google Authenticator. Both are free, work offline, and are far more secure than SMS codes. If your team uses a mix of services, Microsoft Authenticator works with non-Microsoft accounts too, it supports any service that uses standard TOTP codes.
Secure Your Business. Talk to TechCloud
Enabling MFA is one of the fastest, cheapest security improvements any business can make. It costs nothing on the platforms you're already using, takes 30 minutes for a team of 10, and blocks virtually all automated attacks. If you're not sure where to start, or you want someone to handle the setup across your whole team, we're here to help.
Contact TechCloud for a free security assessment, we'll tell you honestly where your gaps are and what it would cost to fix them.
This article is part of our IT startup guide for South Africa, a practical checklist covering email, equipment, cloud, security, POPIA, VOIP, and IT support for new businesses.