The FTC Safeguards Rule and the IRS expect multifactor authentication on every system that holds client data. Here’s how firms can meet that expectation and stop the attacks designed to get around it.