Multi-factor authentication

A second factor through the channel each person already uses

Google Authenticator, Microsoft Authenticator, SMS, WhatsApp, Telegram, email or passkey. Required by role rather than for everyone alike, and every sign-in is recorded with the factor that was used.

What a second factor solves, and what it does not

A leaked password stops being a serious problem the moment there is a second factor in the way. Multi-factor authentication combines proofs from different categories — something you know, something you have and something you are — and Kimobox delivers it through the channel each person already uses: an authenticator app, SMS, WhatsApp, Telegram, email or a passkey. It is required by role, with recovery codes and a record of every sign-in, because demanding it everywhere for everyone is the fastest way to get the code written down on a sticky note.

Content reviewed on 26 August 2026

Legal framework: Article 32 of the GDPR Requires technical measures appropriate to the risk; it does not name MFA, but MFA is the standard measure for remote access to personal data
Public sector: Spanish National Security Framework Royal Decree 311/2022 strengthens the authentication mechanism according to the system category
Security standard: ISO/IEC 27001:2022, control 8.5 Secure authentication, among the 93 controls of Annex A
Time-based codes: RFC 6238 (TOTP) Six digits computed on the device from the clock; they work offline
SMS codes: A restricted channel NIST SP 800-63B ranks it below other factors because of the SIM swapping risk
Passkeys: WebAuthn (W3C) A cryptographic key bound to the device: there is no code to intercept or reuse
The three categories: Knowledge, possession and inherence The same classification Delegated Regulation (EU) 2018/389 uses for strong customer authentication

Authenticator apps

Google Authenticator, Microsoft Authenticator, Authy or 1Password: six digits that change every thirty seconds, computed on the phone itself with no need for coverage.

SMS, WhatsApp and Telegram

A one-time code through the channel the person already has open. Useful for shop, site or warehouse staff without a corporate mailbox.

Email

The simplest way in: a code to the verified mailbox, with a short expiry and a single attempt per code.

Passkeys and FIDO2 keys

WebAuthn sign-in with fingerprint, face or a physical key. There is no code to intercept and none to type.

Policy by role

Mandatory for administration and personal data, optional for read-only access. The policy is set per role, not person by person.

+ info

Every sign-in recorded

Who signed in, when, from where and with which factor. Failed attempts are kept too, which is where the problems show up.

+ info

Where to require it

Actions worth protecting with a second factor

Access to the admin panel and to user and permission management
Viewing payslips, contracts and personal data in the employee portal
Signing documents and approving expenses above a set amount
Exporting or bulk-downloading documentation
Access from an unusual network, device or country
Password recovery and changes to the contact email or phone number

Real examples

Three situations where the second factor decides the outcome

Manufacturing · platform administration

Four people holding admin permissions

Before A single shared administrator account kept in a password manager. When a setting changes, nobody can say who changed it, and one of those four leaving forces a password change for all of them.

After One user per person, with a mandatory second factor on the administration role. The log keeps the name, the time and the verification channel, and a leaver is handled by disabling one user.

Retail · staff without a corporate mailbox

Verifying people who have no company inbox

Before A second factor by email reaches nobody: shop staff have no corporate account and use their personal phone to check the rota.

After A code by WhatsApp to the same number that already receives the rota, with no new app to install and no mailbox to create and then maintain.

Services · leaked credentials

A reused password turns up in someone else's breach

Before Somebody signs in with the correct password from a country where the company does not operate. The access looks legitimate and is spotted weeks later, while reviewing a bulk document download.

After The attempt stops at the second factor, raises an alert to the account holder and the administrator, and stays in the failed-attempt log with its source address.

Vocabulary

The terms that get mixed up around MFA

Knowledge factor: Something the person knows: a password or a PIN. It is the easiest factor to steal, because it can be copied without the owner noticing.
Possession factor: Something the person has: the phone with the authenticator app, the SIM card that receives the SMS, or a physical security key.
Inherence factor: Something the person is: a fingerprint or facial recognition. In passkeys it unlocks the key held on the device, and the biometric data never leaves it.
TOTP: Time-based one-time password, defined in RFC 6238. Device and server share a key and compute the same code from the clock, without exchanging anything.
OTP: A one-time code. It is valid for a single sign-in and expires within minutes, whether it arrives by SMS, WhatsApp, Telegram or email.
Passkey: A cryptographic credential that replaces the password. The private key never leaves the device and the service only stores the public one, so a server breach exposes nothing reusable.
SIM swapping: A technique where an attacker obtains a duplicate of the victim's SIM card and receives their text messages. It is why an SMS code is considered the weakest of the available factors.
Recovery codes: A list of single-use codes handed over when the second factor is enabled. It is the intended way out when the device is lost, and it should be kept somewhere other than that device.
Single sign-on (SSO): A mechanism where one corporate identity opens several applications. It works alongside MFA: the second factor is requested once, at the identity provider.

Frequently asked questions

What people ask us before getting started

What is multi-factor authentication?

It means requiring two or more proofs of identity from different categories: something you know (a password), something you have (a phone, a key) and something you are (a fingerprint, a face). Two passwords in a row are not multi-factor, because both belong to the same category.

Which channels does Kimobox support?

TOTP apps such as Google Authenticator or Microsoft Authenticator, a code by SMS, WhatsApp, Telegram or email, and passkeys or FIDO2 keys through WebAuthn. Each person can register more than one method and keep one as a fallback.

Does the law require MFA?

No Spanish rule demands it by that name for every company. Article 32 of the GDPR requires technical measures appropriate to the risk, and for remote access to personal data a second factor is now the standard measure. In the public sector, the Spanish National Security Framework strengthens the authentication mechanism according to the system's category, and ISO/IEC 27001:2022 covers it in control 8.5 on secure authentication.

Is an SMS code safe?

Far better than no second factor, and worse than the rest. The NIST SP 800-63B guidance classes the telephone network as a restricted channel because of the risk of fraudulent SIM swapping and interception. It works as a way in or as a fallback; for accounts with broad permissions a TOTP app or a passkey is the better choice.

What if someone loses their phone?

Enabling the second factor generates single-use recovery codes to be kept separately. If those are gone too, an administrator can reset the factor, and that reset is logged with its author and reason, because it is exactly the door an attacker would try.

Does it work without coverage or data?

TOTP apps do: the code is computed on the device from a shared key and the clock, as defined in RFC 6238, with no connection at all. SMS, WhatsApp, Telegram and email need a network.

Can it be required only for some roles?

Yes, and that is the advisable approach. Asking everyone for a second factor to check the holiday calendar breeds resentment and adds little; asking it of whoever manages users or downloads payslips does not.

What is stored about the phone number?

The number the person registers to receive the code, for that purpose and no other. It is not used for marketing, it is not shared, and it is deleted when that verification method is removed.

Are 2FA and MFA the same thing?

Two-factor is the most common case of multi-factor authentication: exactly two. MFA is the general term, and it allows three or more when the risk justifies it.

Turn on the second factor in the demo and see for yourself

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

Regulation (EU) 2016/679 (GDPR), article 32: security of processing EUR-Lex · 27 April 2016
RFC 6238: TOTP, time-based one-time password algorithm IETF · May 2011
NIST SP 800-63B, Digital Identity Guidelines: authentication and lifecycle management NIST · June 2017
Web Authentication (WebAuthn) Level 2, W3C Recommendation W3C · 8 April 2021
Delegated Regulation (EU) 2018/389, strong customer authentication (article 4) EUR-Lex · 13 March 2018
Royal Decree 311/2022, Spanish National Security Framework BOE-A-2022-7191 · 4 May 2022

Multi-factor authentication with TOTP, SMS, WhatsApp, Telegram and passkeys

Kimobox includes multi-factor authentication with time-based one-time password apps compatible with the TOTP standard — Google Authenticator, Microsoft Authenticator, Authy or 1Password — one-time codes by SMS, WhatsApp, Telegram and email, and passwordless sign-in through passkeys and FIDO2 security keys compliant with WebAuthn.

Two-step verification is configured per user role, with recovery codes, a fallback method, audited resets and a full log of sign-ins and failed attempts, in line with article 32 of the General Data Protection Regulation and control 8.5 of ISO/IEC 27001:2022.