Two-Factor Authentication, Explained

What is two-factor authentication?

Two-factor authentication (2FA), also called multi-factor authentication (MFA), adds a second check when you sign in. Besides something you know (your password), you also prove something you have (your phone or a security key) or something you are (a fingerprint or face).

Even if a criminal steals your password, they can't get in without that second factor. It's one of the most effective security steps you can take.

Types of 2FA, from good to best

• Text message (SMS) codes: much better than nothing, but codes can be intercepted or a phone number hijacked through a "SIM swap".
• Authenticator apps: apps such as Microsoft Authenticator or Google Authenticator generate a fresh code every 30 seconds on your phone. Stronger than SMS.
• Push approvals: your phone asks "Is this you signing in?" Convenient, but only tap Approve when you're actually signing in yourself.
• Passkeys and security keys: a physical key or a passkey stored on your device. These are the strongest option and resist phishing, because they only work on the real website.

Which accounts to protect first

1. Email: whoever controls your email can reset most of your other passwords.
2. Password manager.
3. Banking and payment accounts.
4. Work accounts such as Microsoft 365 or Google Workspace.
5. Cloud storage and social media.
6. Domain, hosting and website accounts for businesses.

Don't lock yourself out: backup codes

When you turn on 2FA, most services give you a set of one-time backup codes. Print them or save them in your password manager. They let you get back into your account if your phone is lost, broken or replaced.

Watch out for "MFA fatigue"

Some attackers who already have your password send repeated sign-in approval requests, hoping you'll tap Approve just to make them stop. If you get an approval request you didn't trigger, deny it, and change that account's password, because someone else knows it.

Never share a code

No real bank, company or IT support person will ever ask you to read out a 2FA code. If someone calls, texts or emails asking for one, it's a scam. Hang up and contact the company using a number you trust.