Multi-Factor Authentication for Indian Enterprises: What Stops Account Takeovers and What Doesn't

Stolen access is where many Indian incidents start

When an attacker gains access to an account, many serious incidents can follow. Sophos's State of Ransomware in India 2026 has surveyed 240 IT and cybersecurity leaders. The main causes of attacks include malicious email at 28%, phishing at 26%, compromised credentials at 19%, and exploited vulnerabilities at 11%. The report was about ransomware, but the pattern is that attackers usually log in rather than break in.

A similar pattern we saw in IBM’s 2026 India breach research. In this, we found that phishing with voice and SMS phishing is the most common method of attack, at 19%. The average breach cost a record INR 25.5 crore, which was 15.9% higher than the previous year. A password only is not strong enough to protect from these kinds of risks. Because of this, multi-factor authentication (MFA) has become a basic security requirement.

What the regulation actually requires

For payment systems, the RBI's Authentication Mechanisms for Digital Payment Transactions Directions, 2025 require every covered digital payment transaction to use at least two different authentication factors. One factor needs to be dynamically generated and linked to the transaction, or it should be something to be proven, like biometrics. The basic requirements took effect on 1 April 2026. These all apply to the payment system providers and participants, which include both banks and non-banks. SMS OTP is still an example of a qualifying factor. But it is important that the regulations do not set the strongest protection; they set the minimum requirements. An enterprise should not stop at the minimum option that protects employee logins, admin consoles, and internal applications; it can use stronger controls.

What MFA stops, and what it doesn't

The following is our analysis instead of the report finding we saw above. MFA works very well when the attackers only have guessed and stolen passwords. But MFA can also get weak when the user is tricked into giving away the second factor.  For example, the user can enter the code on the fake login page or approve the push request that they did not start.

No MFA method can stop every attack. So, the main question is what will help reduce the damage if the factor gets compromised. There are three things that are especially useful.

1. A stronger second factor: A second factor that is connected to a different login and needs approval from another device is harder to misuse than a code that can be shared easily.
2. Restrict where users can log in: Login restrictions can block some types of attacks. For example, a stolen account used from an unexpected country can be refused.
3. Keep complete authentication logs: Log every authentication event and share the information with the team so that they can check if something is wrong.

How EICE Technology supports enterprise MFA

Verilock is EICE Technology's enterprise multi-factor authentication platform. It supports standards-based TOTP codes (RFC 6238) and push approval. With push approvals, the user can approve or deny the request from the notification with cryptographically signed responses. Geo-fencing allows administrators to restrict login by country; it can be turned on or off for every registered application. Every authentication event is logged for auditing, and applications can register using a QR scan in minutes. Verilock works with third-party TOTP services, so that existing accounts can be brought into one process.

If your team is reviewing how to protect staff logins beyond SMS codes, we'd welcome the conversation.