Two-factor authentication, also called 2FA or multi-factor authentication, asks for a second and different kind of proof when you sign in. It works because two proofs from different categories are far harder to steal together than one password. The method you choose decides how much of that protection you actually get, since some second factors can be intercepted or relayed to a fake login page.
Why one password is not enough
A password fails in two predictable ways. People reuse the same one across services, and large breach files of leaked logins get passed around and tested automatically against many sites. That is why an old password from a forum you forgot about can be the key to your email today. A second factor breaks that chain: the stolen password alone stops working. cisa.gov runs a public campaign on exactly this, because account takeover usually starts with a password that was already exposed somewhere else.
The three kinds of factor
Factors are grouped by what they prove, and a real second factor must come from a different group than your password:
- Something you know – a password, a PIN, an answer to a security question.
- Something you have – a phone running an authenticator app, a hardware security key, a smart card.
- Something you are – a fingerprint or a face scan.
Two passwords are not two factors. In practice a fingerprint or face scan usually unlocks something stored on a device and confirms that a person is present, rather than standing alone as the whole second step.
Not every second factor is equal
- A code sent by SMS or voice call is the weakest common option. The number can be moved to another SIM or intercepted, and NIST treats phone-network out-of-band authentication as a restricted method, expecting services to weigh signals such as a SIM change or number porting before sending a secret that way.
- A code from an authenticator app is generated on the device without any network, so there is no SMS channel to hijack and each code is used once. It is a real improvement, but you still type it into a page, so it can be captured and replayed in real time.
- A push approval is convenient and easy to abuse. NIST requires the secret to be transferred to the out-of-band device rather than displaying a bare approve button, because attackers have generated a flood of requests until someone tapped approve to stop the noise.
- A passkey or hardware security key is the strongest option most people can turn on today. The credential is tied to the real site address, so NIST describes this binding as phishing resistant: a look-alike page cannot relay it to the genuine service.
The standards behind these categories are public, and pages.nist.gov sets out how each authenticator type is classified.
Where two-factor authentication still fails
MFA moves the attack rather than ending it. A proxy page that sits between you and the real site can pass your typed code straight through, a swapped SIM defeats SMS, and the weakest link is often account recovery: if an emailed link or a support call can reset the account without the second factor, that path becomes the way in. ncsc.gov.uk explains which types of MFA withstand these attacks and which only look reassuring.
Setting it up in practice
- Start with the email account that everything else resets through, then banking and any account holding payment details.
- Prefer a passkey or a security key, then an authenticator app, and treat SMS as a fallback rather than a destination.
- Register two methods or two devices so one lost phone does not lock you out.
- Store recovery codes somewhere offline and separate, not inside the account they unlock.
- Keep the recovery email and phone number current, and remove old devices from the account’s security settings.
The bottom line
Adding a second factor is one of the highest value changes you can make to an online account, and the strongest options are now built into mainstream services. Turn it on first where reset access lives, choose a phishing resistant method where you can, and remember that the recovery route is part of the same security decision.