How should organisations implement two-factor authentication in high-risk digital services without creating unnecessary user friction?

Why This Matters for Security Teams

Two-factor authentication only reduces risk when the second factor is hard to phish, hard to intercept, and proportionate to the transaction being protected. High-risk digital services often fail when organisations apply one uniform MFA policy to every login, then discover that attackers only need the weakest path, whether that is SMS interception, push fatigue, or overly broad step-up exemptions. Current guidance from NIST Cybersecurity Framework 2.0 supports risk-based control selection rather than blanket enforcement, which is why this question is really about assurance, not just login friction.

For non-human identity risk, the same pattern appears in NHI governance: broad trust assumptions create easy compromise paths. NHIMG’s Ultimate Guide to NHIs — Why NHI Security Matters Now notes that NHIs outnumber human identities by 25x to 50x in modern enterprises, which helps explain why weak authentication choices scale into systemic exposure. Security teams also learn from the Top 10 NHI Issues that overly permissive access and weak lifecycle controls turn convenience into an attack surface.

In practice, many security teams encounter MFA bypass or account takeover only after fraud, credential stuffing, or support desk abuse has already occurred, rather than through intentional design review.

How It Works in Practice

A practical 2FA design starts by classifying the transaction, not the user. Low-risk actions can tolerate lower-friction factors, while privileged, financial, or data-changing actions should require stronger step-up verification. For those high-risk moments, app-based one-time passwords or push approvals are usually preferable to SMS because they reduce telecom dependency and raise the bar for interception. That aligns with the broader identity principle in NIST SP 800-53 Rev 5 Security and Privacy Controls, which emphasises control selection based on impact and risk.

• Use baseline 2FA for ordinary access, but trigger step-up at password reset, payout, privilege elevation, device enrolment, or sensitive record changes.
• Prefer phishing-resistant options where possible, especially for admins and service operators who can cause outsized damage.
• Make enrolment explicit and recoverable, with clear backup methods and support workflows that do not rely on weak identity proofing.
• Monitor for anomalous MFA prompts, repeated failures, new devices, and geo-velocity patterns that suggest token theft or push fatigue.

This design also benefits from lessons in NHI hygiene. If credentials or tokens are reused, long-lived, or poorly revoked, strong 2FA at login is only one control in a much larger trust chain. NHIMG’s Ultimate Guide to NHIs — Key Challenges and Risks highlights how excessive privileges and weak rotation amplify blast radius after any account compromise. The operational goal is to reduce the chance that a single stolen factor becomes a durable foothold. These controls tend to break down when legacy applications cannot support modern authentication flows because exceptions quietly become the real policy.

Common Variations and Edge Cases

Tighter authentication often increases enrolment burden and support cost, so organisations must balance security gain against drop-off, accessibility, and recovery risk. That tradeoff is especially important in consumer-facing services, regulated workflows, and environments with shared devices or poor mobile coverage.

One common edge case is when SMS remains necessary for reach. Current guidance suggests treating SMS as a fallback rather than a preferred factor, but there is no universal standard for this yet. Where adoption depends on broad accessibility, SMS may still be acceptable for lower-risk actions if it is paired with strong rate limiting, fraud analytics, and robust recovery controls. Another edge case is step-up fatigue: if users are challenged too often, they begin approving prompts reflexively, which defeats the point. For that reason, risk engines should tune prompts to behavioural context, not just static roles.

Another practical exception is account recovery. Recovery is often the weakest point in the authentication chain, so the strongest 2FA policy can be undone by weak reset processes, help-desk social engineering, or email-only verification. That is why best practice is evolving toward context-aware assurance, not just factor counting. In high-risk services, this also means aligning authentication with ISO/IEC 27001:2022 Information Security Management controls for access governance and incident readiness, while keeping the experience as lightweight as the threat model allows.

Related resources from NHI Mgmt Group

• How should security teams implement stronger authentication without creating more user friction?
• How should security teams implement context-aware authentication without creating too much user friction?
• How should mobility platforms implement biometric authentication without creating unnecessary friction?
• How should security teams implement zero trust authentication without adding too much user friction?