Multi-factor authentication is a security method we use to keep your account secure. MFA can block over 99,9% of account compromising attacks. By combining multiple factors of authentication, access control security is tightened. ‘Multi’ is often replaced by the number of factors, for example two-factor authentication of which your email address and your password is the first factor.
Users can choose from the following authentication methods to comply with the MFA requirement for logging in to your account:
- via an SMS message
- via a phone call
- via an authenticator app (recommended)
- via a security key (most secure - This can only be setup via User details.)
If you want to change your default MFA method, please follow this link.
How We Protect Your Account with Multi-Factor Authentication (MFA)
We take the security of your account seriously. To ensure only you can access your account - without adding unnecessary friction to your day-to-day experience - we use Adaptive Multi-Factor Authentication (MFA), powered by Auth0, a leading enterprise identity and security platform trusted by thousands of organisations worldwide. Auth0 continuously monitors the threat landscape and keeps its security capabilities up to date with the latest industry standards, so you can be confident you're protected by best-in-class technology.
What is Adaptive MFA?
Unlike traditional MFA that always requires a second verification step, Adaptive MFA intelligently evaluates the risk level of each login attempt in real time. When a login looks normal and consistent with your usual behaviour, you won't be interrupted. When something looks unusual or suspicious, you'll be prompted to verify your identity with a second factor.
Requiring MFA on every login - regardless of context - is no longer considered best practice in modern identity security, and is not something we support. Blanket MFA creates unnecessary friction and can lead to alert fatigue, where users become desensitised to verification prompts and are therefore more vulnerable to social engineering. Adaptive MFA addresses this by applying stronger verification precisely where it is needed.
This approach is also directly aligned with Zero Trust principles as implemented in modern Identity and Access Management (IAM) frameworks. Zero Trust operates on the premise that no login should be implicitly trusted - not even from a known user on a familiar device. Rather than enforcing a fixed verification step for everyone, every time, it calls for continuous, context-aware evaluation of each access request. Adaptive MFA is the practical expression of this: authentication strength scales with assessed risk, ensuring that trust is always earned, never assumed.
How does the risk assessment work?
Each time you log in, Auth0 automatically runs a risk assessment based on three signals:
- New Device - Checks whether you're logging in from a device that has been seen before. A completely unfamiliar device or browser raises the risk level.
- Impossible Travel - Analyses the geographic location of your login against your recent login history. If it appears physically impossible to have travelled between two login locations in the time elapsed, this is flagged as suspicious.
- Untrusted IP - Cross-references your IP address against Auth0's continuously maintained threat intelligence database. IPs associated with known abuse, anonymising services (such as VPNs, proxies, and TOR exit nodes), botnets, or poor reputation scores are flagged accordingly.
Each signal produces a confidence score - high, medium, or low - reflecting how closely the login matches your normal patterns. These are combined into an overall confidence score for the session.
When will MFA be triggered?
We have configured our MFA policy to trigger a second verification step whenever the overall confidence score is medium or low. This means:
- A low confidence score - where the login clearly deviates from your normal behaviour - will always prompt MFA.
- A medium confidence score - where there is some uncertainty about the login - will also prompt MFA, providing an extra layer of caution beyond the default.
- A high confidence score - where the login closely matches your established patterns - will allow seamless access without interruption.
Bot Protection
In addition to Adaptive MFA, we have enabled Auth0's Bot Protection, which actively detects and blocks automated login attempts and credential-stuffing attacks before they ever reach the authentication stage.
In summary
Your account is protected by a layered, intelligent security system that works quietly in the background. Most of the time you'll log in without any extra steps. When something looks out of the ordinary, we'll ask you to confirm it's really you. This balance between security and convenience is made possible by our partnership with Auth0, whose platform is purpose-built for enterprise-grade identity security and kept current with evolving threats - so we don't have to manage that complexity ourselves.