What is two-factor authentication?
Definition
Two-factor authentication (2FA) is a login check that asks for a second proof of identity, such as a code from your phone or a security key, on top of your password, so a stolen password alone can't open your account.
- Category
- Security
- Also called
- 2FA, two-step verification, multifactor authentication, MFA
- Last updated
With a password only, anyone who learns it can log in as you. 2FA adds a second check from a different category. CISA describes three: something you know (a password or PIN), something you have (a phone, a hardware key, a smart card) and something you are (a fingerprint or face scan). Two or more of those together is multifactor authentication (MFA). 2FA is the two-factor case, and many sites call it "two-step verification".
In practice you type your password, then the site asks for a 6-digit code, a tap on a push notification or a press of a security key. A leaked or guessed password then isn't enough on its own. That matters because passwords leak in breaches all the time and many people reuse them across sites.
Not all second factors are equal
CISA warns that codes sent by text message, codes from authenticator apps and push approvals can all be tricked by phishing or other bypass attacks. A fake login page can ask for your code and pass it to the attacker in real time. Security keys and passkeys based on the FIDO standard are the phishing-resistant options.
Still, almost any 2FA beats none. Use the strongest method a site offers, and use an authenticator app or key over text messages when you have the choice.
2FA vs. a security code
The code you type during 2FA is a one-time verification code. It's different from the 3 or 4 digits on the back of your card. Never read a verification code out to anyone who contacts you, whatever they claim: the FTC says that is how scammers get into accounts.
How to protect yourself
- 1
Turn it on for email first
Your email account resets every other password you have. Open its security settings and look for "2-step verification", "two-factor" or "multifactor".
- 2
Prefer a key, passkey or authenticator app
If a site offers a security key or passkey, pick that. An authenticator app is the next best choice. Text messages work but are the easiest to intercept or trick.
- 3
Never share a code
Banks, delivery apps and support teams don't ask you to read out a verification code. If someone does, hang up or stop replying.
- 4
Save your backup codes
Store the recovery codes a site gives you somewhere offline, so losing your phone doesn't lock you out.
- 5
Cut down what attackers can use
Scammers aiming to take over accounts start with your phone number and email. Serus finds where your contact details are listed and removes them, which makes you harder to target.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is two-factor authentication the same as multifactor authentication?
2FA is MFA with exactly two factors. MFA means two or more. Websites use "2FA", "two-step verification" and "MFA" more or less interchangeably.
Is text message 2FA safe?
It's better than a password alone, but CISA lists SMS codes among the methods that can be bypassed. Use an authenticator app, passkey or security key where you can.
What if I lose my phone?
Use the backup codes the site gave you when you turned 2FA on, or the account recovery process. This is why saving backup codes matters.
Sources
Something wrong or out of date? Tell us and we'll re-check it.