Staying Ahead of Cyberattacks with MFA

Of that subset, 93% reported falling victim to phishing and 35% succumbed to malware attacks.¹ 

One of the easiest ways to safeguard against an attack is multi-factor authentication (MFA). MFA significantly reduces the risk of unauthorized access by requiring multiple forms of identification.

How MFA Works (Combination of 2 out of 3)

Depending on the platform, MFA may include a blend of authentication prompts, such as text message (SMS) or voice message, or biometrics, like fingerprints or face scan. It can be deployed across email, bank and social media accounts, as well as online stores and streaming services.
 

If you don’t see an option for MFA on these applications, you can always reach out to the respective company, asking if they can enable the feature.

Social Engineering and Red Flags

Social engineering is an attempt to manipulate individuals into giving away sensitive information.
 

Three of today’s most common social engineering attacks are:
 

• Phishing: Attackers use deceptive emails, messages or websites to impersonate trusted individuals or organizations, with the goal of tricking victims into revealing passwords, credit card numbers or personal details.
• Remote access scams: Attackers pose as a trusted entity, such as tech support or a service provider, to gain remote control of victims’ computers or devices, allowing them to steal personal information, install malware or demand payment to fix fake issues.
• Vishing or Voice Phishing: Scammers pose as trusted organizations, such as banks or government agencies, using phone calls or voice messages to get victims to reveal passwords, credit card numbers or other personal details.

It is also worth noting that advancements in artificial intelligence (AI) have led to a rise in cyberattacks. Since late 2022, there has been a 1,200% surge in phishing attacks.²

Beware of These Red Flags:

Best Practices to Safeguard Against Social Engineering:

Social engineering can take many forms, but its end goal is always to deceive targeted individuals into sharing confidential information.
 

1. Enable MFA wherever possible, selecting the strongest available option, as not all offer the same level of protection.
2. Do not click links or open attachments from unknown or unsolicited sources.
3. Never disclose passwords, PINs or confidential data via phone, email or messaging without proper verification.
4. Use verified contact details to reach out to the person or organization requesting information, so you can avoid fraud.
5. Only permit remote connections to your computer or mobile device in trusted situations and ensure that access is carefully monitored and secured.
6. Generally, avoid approving MFA requests you did not initiate.

If something feels off, trust your instincts and verify anyone who asks for access. And at BNY, you can always contact Wealth Online Support, where MFA is required, or reach out directly to your relationship team to confirm whether a request is genuine. With these best practices, you should feel empowered in your everyday digital interactions.

_{¹ Deloitte: The Family Office Insights Series – Global Edition, The Family Office Cybersecurity Report, 2024.}

_{² McKinsey & Company: AI is the greatest threat—and defense—in cybersecurity today. Here’s why. May 15, 2025.}