Authentication is the process of proving that a user is who they claim to be. For employers it is the gate in front of every system holding workforce data, and the strength of that gate determines whether a leaked password anywhere on the internet becomes a payroll incident.
It is worth separating from a related idea it is often confused with. Authentication establishes identity; authorization determines what that identity may do. A system can authenticate someone perfectly and still hand them far more access than their role requires.
Something you know — a password or PIN. The weakest on its own, because it can be guessed, reused, phished, or stolen in bulk from an unrelated breach.
Something you have — a phone running an authenticator app, a hardware key, or a code sent by SMS. Requires the attacker to possess a physical object, which is a meaningfully higher bar.
Something you are — a fingerprint or face scan. Convenient, and worth noting that biometric data is separately regulated in a growing number of jurisdictions, with notice and consent requirements that apply to employers using it for timekeeping or device access.
Combining two different types is what makes authentication meaningfully stronger. Two passwords are not two factors.
The failure is not that people choose bad passwords. It is that people reuse good ones.
An employee sets a strong password, uses it on a dozen sites, and one of those sites is breached. The credentials appear on a list that is tested automatically against thousands of employer logins. The password was never guessed — it was simply reused somewhere the employer has no control over.
This is why guidance has shifted away from complexity rules and mandatory rotation toward length, uniqueness, and a second factor. Forced periodic rotation in particular tends to produce predictable variations and drives passwords onto sticky notes, without meaningfully improving security.
Not every system carries equal consequence, and rolling out stronger authentication everywhere at once usually stalls. A sensible order:
The self-service portal is the one most often skipped, on the reasoning that it is employee-facing rather than administrative. That reasoning misses the point: it is the fastest route from a stolen password to a diverted paycheck.
Requiring a second factor at every login for a large hourly workforce generates real friction and real resistance. Step-up authentication offers a middle path: the session proceeds normally for routine activity, and a second factor is required only at the moment of a sensitive action — changing banking details, changing tax withholding, or updating contact information.
This concentrates the friction precisely where the risk is and is considerably easier to get accepted than blanket prompting.
Employers also authenticate people outside of systems, and those moments deserve the same rigor. Confirming that a direct deposit change request genuinely came from the employee is an authentication decision made by a person rather than a computer — and the correct method is the same in principle: verify through a channel the requester did not supply.
Treating it that way helps staff understand why replying to the email is not verification. The reply travels through the channel the attacker controls.
Cyber insurance applications now routinely ask whether multi-factor authentication protects email and remote access, and coverage or pricing can turn on the answer. Clients in regulated sectors increasingly require evidence of it from vendors. And after an incident, the question of what authentication was in place is among the first asked.
Employer's Guardian helps employers set authentication standards across payroll and workforce systems through EGPay workforce management.
This article provides general educational information, not legal, tax, or insurance advice. Biometric and privacy requirements vary by jurisdiction. Consult qualified counsel before deploying biometric authentication.