Most account takeovers begin with a stolen or guessed password. Passwords leak in data breaches, get reused across sites and are easy to hand over to a convincing fake login page. The standard remedy is a second step when you sign in. But “two-factor authentication” covers methods that range from a text message, which is better than nothing, to hardware keys that resist even skilled phishing.
What “two-factor” actually means
Authentication factors fall into three categories: something you know, such as a password or PIN; something you have, such as a phone or hardware key; and something you are, such as a fingerprint or face scan. Two-factor authentication, often shortened to 2FA, combines two different categories. The wider term is multifactor authentication, or MFA.
The idea is that stealing one factor is not enough. An attacker who has your password still needs your phone. The strength depends on how the second factor works and how easily it can be intercepted or tricked out of you.
How the common methods compare
Text-message codes. A six-digit code arrives by SMS. They are convenient and require no app, which is why many services offer them. The weaknesses are known: codes can be intercepted in some circumstances, and attackers have used “SIM swapping” to convince a phone carrier to move a victim’s number to a device the attacker controls. A code can also be requested and then talked out of you by a scammer posing as your bank.
Authenticator apps. The app generates a short-lived code on your device, usually refreshed every 30 seconds, based on a secret shared when you set up the account. Because the code does not travel over the phone network, this avoids SIM swapping. It is still vulnerable to phishing, since a fake site can ask for the code and use it immediately.
Push approvals. The service sends a prompt to your phone asking you to approve or deny. They are easy to use, but attackers have exploited them with “prompt bombing,” sending request after request until a tired user taps approve. Number-matching, where you must type a number shown on the login screen, reduces the risk.
Security keys. These are small hardware devices, connected by USB or tapped on a phone, that follow standards from the FIDO Alliance. The key proves its identity cryptographically to the specific website. Since it checks the real address of the site, it will not work on a look-alike page, which makes it phishing-resistant.
Passkeys. Built on the same FIDO2 and WebAuthn standards, a passkey replaces the password with a pair of cryptographic keys. The private key stays on your device and is unlocked with your fingerprint, face or device PIN. The website stores only the public key, so a breach of the site does not expose anything an attacker can reuse. Like security keys, passkeys are bound to the site they were created for and resist phishing.
Why does “phishing-resistant” matter?
Phishing is the leading way accounts are compromised, and it defeats any method where a person types or approves something that an attacker can relay in real time. The U.S. Cybersecurity and Infrastructure Security Agency recommends phishing-resistant MFA, meaning FIDO-based methods, for the most sensitive accounts and for organizations. The National Institute of Standards and Technology’s digital identity guidelines also treat SMS codes as a restricted, weaker authenticator and place hardware-backed cryptographic methods at the top.
None of this means weaker methods are worthless. Studies published by large providers have found that adding almost any second factor blocks the great majority of automated attacks. The ranking matters most against targeted attackers.
Which accounts should come first?
Start with the accounts that unlock the others:
- Primary email. Password resets for nearly everything else go there.
- Password manager. If you use one, protect it with the strongest option available.
- Banking, brokerage and any crypto accounts.
- Phone carrier and Apple or Google accounts, which can reset many things.
- Work accounts and social media.
For services that offer passkeys, turning them on is usually a few taps. People who prefer to keep passwords can use an authenticator app, and a hardware key suits anyone who wants the highest level of protection.
Pitfalls to avoid
- Recovery routes. An attacker can sometimes bypass a strong method by exploiting a weak recovery path, like a text code or a security question. Check what happens if you lose your device, and remove weaker fallbacks where the service allows.
- Backup codes. Save the one-time backup codes that services provide, and store them securely offline or in a password manager.
- Losing the device. Passkeys that sync through a platform account, such as an Apple or Google account, can be recovered on a new device. Keep a second security key as a backup if you rely on hardware.
- Shared devices. Be careful about enrolling a passkey on a computer you do not control.
If a service you use reports an incident, strong authentication limits the harm, and it is part of the practical checklist in what to do after a data breach. It is also central to protecting exchange accounts discussed in crypto custody, where a stolen login can lead directly to lost funds.
Sources: Cybersecurity and Infrastructure Security Agency; National Institute of Standards and Technology; FIDO Alliance; Federal Trade Commission
