What is two-step authentication?
Two-step verification, also called multi-factor authentication (MFA), asks for your password plus a second step, like a code sent to your phone. This makes it much harder for someone else to sign in as you.
A two-step sign-in is a trust and security feature that typically requires you to present a combination of something you know, like your password, along with something you have, such as a one-time code sent by text or email or a passkey saved on your phone. Passkeys are saved on your phone or computer, and you unlock them with your fingerprint, face, or device PIN. (Passkeys are only available in Realm.)
The bottom line is that two-step verification asks for your password plus one more step so that a stolen password isn't enough for a bad actor to sign in and access your account.
Why does MFA matter for churches?
Churches are attractive targets. Members trust their church, staff and volunteers change often and sometimes share logins, and church records can include pastoral care notes, children's information, and giving history.
Your church software holds more than your own information. It holds names, phone numbers, email addresses, and family details for the people in your congregation. When someone signs in with your account, they can see and change what you can.
When scammers get into a staff or part-time volunteer's account, they can contact your members with messages that seem to come from the church. Members respond to these messages because they usually trust their pastors and staff.
A password alone isn't enough to stop this. Two-step verification asks for a second step, like a code sent to your phone, before anyone can sign in as you. Even if someone steals your password, they can't get in without that second step.
If you manage your church's software, require two-step verification for everyone who can edit records. It's one of the most important things you can do to protect your congregation.
Why do I have to identify myself in multiple ways to login?
Because passwords are easy to guess and reuse, and scammers use social engineering and other sophisticated tactics to build profiles and gain unauthorized access, you need multiple ways to identify yourself when you sign in.
People invariably use passwords that are easy to guess, are used on multiple sites, or they change only the last character for each login. A username and password alone is no longer an adequate protection to access your sensitive and valuable information. Together with phishing attempts and other tactics, they can collect details about your life and build a very informative profile about you.
How do I enable two-factor authentication (MFA)
Find your software product in the list below and follow the instructions for enabling two-factor authentication.
Realm, Gather, and MissionInsite utilize ACST One Account Management, which allows you to sign in using text message or passkey and enable two-factor authentication under organization account management.
- MinistryPlatform
- Realm, Gather, and MissionInsite all provide options for sign in using text messaging or passkey.
- Realm Connect (for Leaders and Congregants)
- Require Two-Step Verification for an Accounting Role
- Go Method