Cyber Awareness Month 2026: Use multi-factor authentication to secure online accounts, says CERT-In

CERT-In advised people to enable multi-factor authentication, or MFA, on their online accounts. MFA adds another verification step after the password. This matters because passwords can be stolen, guessed, reused, or exposed in data breaches. The supplied headlines identify MFA as a Cyber Awareness Month 2026 security recommendation.

For example, an account might require a password plus a changing code from an authenticator app. It might instead require a physical hardware security key. The password proves knowledge. The code or key supplies another form of proof. An attacker who has only the password should not pass the second check.

CERT-In specifically urged users to consider authenticator apps or hardware keys. The source also highlights fatigue attacks, push bombing, and SIM swapping as MFA bypass threats. MFA is not an absolute guarantee, but using a stronger second factor raises the barrier and reduces the damage caused by stolen passwords.

Multi-factor authentication verifies identity with at least two independent factors. A password is usually a knowledge factor because the user knows it. MFA adds another factor, such as a device, a generated code, a security key, or a biometric. It matters because one stolen password is not enough to complete the login.

For example, a banking service could request a password and a six-digit code from an authenticator app. The password alone may be correct, but access still fails without the registered device. A hardware key provides a different type of second proof. It responds only when the user physically activates it for the account.

The supplied headlines present MFA as CERT-In’s account-protection advice. They also mention bypass methods, including fatigue attacks, push bombing, and SIM swapping. Therefore, MFA is stronger than password-only protection, but the factor chosen and the way users respond to prompts still matter.

MFA commonly draws from three categories of proof. The first is something the user knows, such as a password or PIN. The second is something the user has, such as a registered phone, authenticator app, hardware security key, or smart card. The third is something the user is, meaning a biometric trait such as a fingerprint or face pattern.

A login might therefore request a password, then a code produced by an authenticator app. Another system might pair a PIN with a hardware key. A phone number can also be used as a possession channel when a service sends a code by text message, although that method has weaknesses. Combining two categories is stronger than repeating the same kind of proof.

The supplied source does not state a number or list these categories. This three-factor model is established authentication practice. CERT-In’s headlines specifically recommend authenticator apps and hardware keys, while warning about MFA bypass techniques such as SIM swapping.

CERT-In recommends authenticator apps or hardware security keys because they provide stronger alternatives to password-only access and can reduce dependence on mobile-phone messaging. A changing app code is generated on a registered device. A hardware key requires physical possession. These controls make a stolen password less useful to an attacker.

For example, a criminal may know a victim’s password but lack the victim’s authenticator device or security key. A hardware key can also use cryptographic checks tied to the legitimate website. That helps resist phishing, where a fake site tries to collect a password and second-factor response. Authenticator codes improve protection, but users must still avoid entering them into fake sites.

The supplied headlines do not explain CERT-In’s technical reasoning in detail. They do specifically name authenticator apps and hardware keys as preferred options, and they mention SIM swapping and other bypass methods. These options therefore address weaknesses associated with stolen passwords and phone-number attacks, though no MFA method is invulnerable.

Enabling MFA creates a second barrier after the password. If someone learns the password, the account can still reject the login because the intruder lacks the required code, device, security key, or biometric. This limits the value of stolen passwords and can give the real user a warning that someone is attempting access.

For example, an attacker enters a correct password and triggers an approval request on the user’s phone. Without the second factor, the login should stop. If the factor is a hardware key, the attacker normally needs that physical key. If it is an authenticator code, the attacker needs access to the code or must trick the user into sharing it.

MFA does not make accounts invulnerable. The supplied headlines specifically mention fatigue attacks, push bombing, and SIM swapping as bypass concerns. Stronger factors and careful approval decisions matter. CERT-In’s recommendation still provides an important defense because a password by itself no longer completes the login.

MFA bypass techniques target people, devices, or delivery channels rather than simply guessing the second factor. In a fatigue attack, also called push bombing, an attacker sends repeated login approval prompts. The user may eventually accept one by mistake, annoyance, or confusion. The attacker then uses that approval to enter the account.

SIM swapping attacks the phone-number channel. A criminal persuades a mobile carrier to move a victim’s number to a SIM card under the criminal’s control. Texted login codes or account-recovery messages may then reach the attacker. These attacks exploit trust in prompts or weaknesses in phone-based verification. They do not mean every MFA method works the same way.

The supplied source names these techniques but provides no detailed incident or statistics. The practical lesson is to reject unexpected prompts, report repeated requests, and prefer stronger options where available. Authenticator apps and hardware keys are the alternatives CERT-In highlights, with hardware keys offering especially strong protection against phishing.

Authentication systems verify account control by comparing a login response with information registered for that account. A password is checked against a stored password verifier. A one-time code is accepted only during its valid period and after it matches the account’s expected calculation. These checks provide evidence that the person controls a particular secret or device.

A registered authenticator app holds a secret that generates changing codes. A hardware key can answer a challenge from the service using a private cryptographic key. The service checks the matching public key and accepts the response only if it is valid. The private key stays inside the hardware, so it is not normally typed or revealed. Device-based approvals use a similar control relationship.

The supplied headlines do not describe these mechanisms. This explanation reflects established authentication practice and clarifies why CERT-In highlights authenticator apps and hardware keys. It also explains why push bombing and SIM swapping matter: attackers try to obtain approval, control a delivery channel, or exploit user behavior instead of proving genuine account control.