Sam Boyd
Fact-checked by Hazel Shaw
Two-factor authentication (2FA) secures your accounts with an extra layer of protection. Instead of just needing a password, 2FA requires an additional piece of information to log in. As a result, overall security is enhanced by enabling 2FA. Even if a hacker acquires your password, your account will likely remain secure.
There are several different ways to implement 2FA. The second ‘factor’ needed to access your account could be a code sent through SMS, email, or an authenticator app. Other common methods involve tapping a pop-up on your phone or using a physical ‘key.’ Each method has advantages and disadvantages (I’ll go over them below), but using any type of 2FA is a good idea for sensitive accounts.
That said, using strong passwords is still critical. Together with 2FA, unguessable passwords are essential if you want to stay safe online. The best practice is to use a high-quality password manager to create, store, and deploy your login details. The best options support several secure 2FA methods, and some (like 1Password) will even alert you to any accounts that could be further secured by adding 2FA.
How Does Two-Factor Authentication Work?
2FA ensures your online banking accounts, personal accounts (like email and social media), and other sensitive logins are protected by more than just a password. With 2FA enabled, even if someone has your password, they’ll need an additional credential to access your accounts.
It’s like locking your front door with a key (factor 1) and a security code (factor 2). Anyone who steals your key has one factor, but they still won’t be able to break into your house. Likewise, someone who spies on you while you enter the code can’t use that alone to open your front door. Therefore, a thief must steal your key and get your code before breaking in. With 2FA enabled, you’ll protect your online accounts with the same level of security.
What Factors Can Be Used for Authentication?
2FA comes in various forms, but the main factors at play can be distilled into the following:
- Knowledge Factor: This is stored in your head, like a password or PIN. Most 2FA systems start with this; you must enter a password or PIN before being prompted to provide the second factor.
- Location Factor: This checks where a user opened an account and compares it to where they’re logging in from now. This is why you might be unable to log into your bank abroad (you can get around this using a reliable VPN with servers in your home country).
- Possession Factor: This method relies on something that only you should have. This could be a one-time password (OTP) generated by an authenticator app, a hardware token, or a prompt sent to your phone.
- Time Factor: The time of day can also determine whether access to an account is granted. For instance, a time factor might not allow access to a professional account after regular working hours.
- Biometric Factor: Technology exists that can restrict access to accounts unless physical proof of identity is given. Also called inherence factors, biometrics relies on a fingerprint, voice sample, facial recognition, or eye scan.
In most cases, 2FA combines a knowledge factor with either a biometric or possession factor. Time or location factors are less commonly used.
Don’t confuse 2FA with multiple single-factor authentication (SFA) options. For instance, if you can access an app on your phone via either biometrics or a password, that’s not 2FA. To qualify as 2FA, you must use a combination of two unique factors to access an account.
Why Should You Implement 2FA?
The best reason to implement 2FA is to increase your account security. The fact is that passwords alone are no longer enough to guarantee your data privacy and security. Adding 2FA will vastly improve the security of your accounts without being much of an inconvenience.
Many users have poor password habits, which leave them open to simple and advanced hacking techniques like password guessing or brute force attacks. However, with 2FA, guessing your password is not enough to access your account.
But what if you have a strong password? That’s great, but one skilled hacker or careless employee could still compromise your excellent password. Alternatively, you might have also set up auto-fill on your device. In this case, anyone physically possessing your device can still use auto-fill to log into your accounts. 2FA ensures an actor would have to jump through another hoop to gain access.
Finally, you’re constantly exposed to security cameras and unscrupulous shoulder-surfers when you use your devices in public. That’s not to mention man-in-the-middle attackers that can intercept your password on a public Wi-Fi network.
In such cases, your second authentication factor saves you from an account breach that could see your money stolen, your accounts seized, and more.
What 2FA Options Do You Have?
These days, there are several different options when it comes to 2FA. What’s available will depend on what the app, website, or online service supports. Each option has benefits and downsides regarding security, convenience, and portability.
I’ve compared the most relevant options below to help you decide which 2FA options to use.
Email/SMS Verification
Pro: Fast and easy setup.
Con: Prone to interception.
Email/SMS verification is the most common form of 2FA. This method validates your login with the help of one-time codes sent via email or SMS. In short, the process looks like this:
- Enter your password to log into an account.
- An OTP is generated and sent via an email or SMS to your phone.
- Fill in the code to validate your login and gain access.
One of the best things about email and SMS verification is that it alerts you to unauthorized logins. You can quickly know that someone is trying to break into your account if you get an OTP you didn’t request. This is a sign that someone has your password, so you should immediately change it.
However, email/SMS verification isn’t perfect. You can get a complete picture of its shortcomings below.
Push Notifications
Pro: Fast and easy setup.
Con: Requires internet connection and a specific device.
Push notifications are sent to your trusted devices for login approval on accounts for which they’re enabled. You can enable push notifications on platforms that natively support it, like Gmail. Alternatively, some 2FA apps allow you to set push notifications for other online accounts without native support.
Many users find push notifications preferable to SMS or email verification since these usually only require you to click “Yes/No” to validate a login. This takes less time than reading and entering a code.
However, push notifications require an internet connection to work. You’ll also need to have a specific device to access accounts secured in this way. Additionally, if you’re not careful, there’s a risk of approving unknown login attempts due to muscle memory.
Authenticator Apps
Pro: Highly secure codes.
Con: Technical setup.
Authenticator apps like Microsoft Authenticator generate 2FA codes to access your linked accounts. Some reliable password managers like Bitwarden and
Like SMS verification, authenticator apps work by providing OTPs. The difference is that these codes are generated locally on your device, so there’s less risk of them being intercepted by a skilled hacker. Unlike push notifications, you don’t need internet access to use them.
That said, authenticator apps require a bit of setup. This usually involves scanning a QR code or entering a unique code to link your online account with the authenticator tool. That also reveals another problem: you might need a device that can read QR codes, which isn’t necessary for SMS verification. I wouldn’t say authenticator apps are complex, but they involve more set up than SMS verification.
Biometric Verification
Pro: Uses physical features unique to you.
Con: Requires hardware with biometric support.
Biometric verification is quickly becoming one of the most popular means for 2FA. It’s user-friendly, fast, and secure. This system uses biometric information — usually your face, fingerprint, voice, or eye — to validate account access. Many smartphones support biometrics, while computer users can use Windows Hello and Touch ID.
The best part about this 2FA method is that no two people share the same biometric signature. Your authentication method is totally unique. In principle, no one should be able to get into your account unless you’re physically present. However, with the rapid rise of technology, weaker forms of biometric authentication can potentially be spoofed by AI, deepfakes, or other techniques.
Fortunately, biometrics security technology is advancing to combat common ways of spoofing it. Apple’s Face ID, for instance, can’t be tricked by a photograph. That said, there are valid concerns that future developments could result in methods of duping certain types of biometrics. Fingerprint authentication is generally believed to be more secure.
Another downside is that many devices do not support biometrics. While more smartphones are shipping with biometric security via fingerprint and facial scan, most computers lack a fingerprint scanner. Furthermore, not all online accounts support biometric 2FA, limiting how much you can implement it.
Hardware Tokens/Security Keys
Pro: Highly secure.
Con: Relies on a physical object that can be lost or stolen.
Hardware tokens or security keys, such as YubiKeys, can generate unique OTPs or simply be plugged into your device to authorize a login. You never need to connect the keys to the internet, eliminating inconvenience and potential security risks.
Even so, they’re often so small that they can get lost. That’s why I recommend getting a backup key, just in case. Moreover, relatively few websites and services support 2FA via hardware keys (though password managers like Keeper are compatible).
How to Enable 2FA on Your Accounts
There’s no one-size-fits-all approach to enabling 2FA on your accounts. The exact steps to increase account security by setting up 2FA will depend on the website or account to which you want to add 2FA and the 2FA method you choose.
Here’s a general step-by-step guide to help you:
- Log into the account to which you want to add 2FA.
- Go to your account settings.
- Look for an account security tab.
- Find 2FA settings. It will probably be labeled something like “Two-Factor Authentication,” “MFA,” or “2-Step Verification”.
- Choose from one of the available options. Some platforms may offer just one 2FA option, while others provide several.
- Follow the rest of the on-screen prompts. You may need to enter an OTP to finalize the setup.
What Are the Limitations of 2FA?
Like any other security system, 2FA has some limitations. Knowing these limitations will keep you informed and help you avoid falling victim to hackers or scammers.
SMS Interception
2FA via SMS verification is useless if the attacker already has access to your mobile phone or remote access to the number where you get the verification codes. One common method employed by hackers is SIM swapping. This involves a cybercriminal convincing your mobile carrier to port your number to another SIM they control, giving them access to your messages (and 2FA codes). Millions of dollars in crypto have been stolen using this method.
Alternatively, the codes can be intercepted since they aren’t generated on your device but sent. Of course, this requires excellent technical skills and resources, but it’s by no means beyond the capacity of skilled hackers.
Social Engineering
Social engineering attacks like phishing and tech support scams can bypass your 2FA. These attacks are designed to trick you into divulging sensitive information. Usually, this is accomplished by convincing the victim that they’re interacting with a trusted third party.
For instance, a scammer could call you and pose as Google. Then, the scammer cooks up a story, such as that they’re helping you fix a technical issue on your Gmail account or protecting you from a hack already in progress.
Once they gain your trust, they ask for your password or 2FA codes sent to or generated on your device. With those details, they can gain unrestricted access to your account.
Hardware Token Compromise
Using low-security hardware tokens could expose you to hackers who know how to exploit such tokens. Likewise, a hacker with your password could steal your token to log into your account on their device.
The worst part of a compromised hardware token is that the hacker may mark their device as one of your trusted devices. Then, they’ll never need to use the token for subsequent logins.
What Are the Downsides to 2FA?
2FA is an essential security tool to have in your toolbox. Still, it’s not without challenges. Here are some of the most common ones you may face and how to minimize issues.
- Reduction in login convenience. You can’t simply enter a password and be done with it anymore. To some, this can be a bit frustrating.
- Device transition challenges. Device-specific authentication methods, such as authenticator apps, may not automatically transfer to your new devices. Similarly, you’ll be locked out of SMS 2FA if you change your phone number. Plan 2FA migration before wiping old devices or getting a new phone number.
- Recovery. Authenticator apps can be difficult to recover if your device gets lost or damaged. Fortunately, they’ll usually provide recovery codes for this purpose. Store them securely and safely.
- Authentication fatigue. You might get tired of authenticating logins on accounts you use multiple times daily. In this case, log in on personal devices and mark them as trusted. Hardware tokens also allow you to mark trusted devices. With these options enabled, 2FA will only be required on new devices.
- Emergency access protocols. Someone you trust, like a family member, might legitimately need to access your accounts in an emergency. You can plan for such instances by securely sharing your authenticator method or access with a trusted person.
- Access during travels. Some authenticator options, like SMS verification, might not work while traveling. So it’s advisable to have multiple options set up to fall back on.
Frequently Asked Questions
What happens if I lose my authentication device?
If you lose the original authentication device, you can recover your 2FA on a new device. The kind of 2FA you use will determine the recovery method. For instance, you can recover SMS authentication by getting your SIM back or using your backup recovery codes to reactivate authentication apps. You may also need to contact a website’s support to change your 2FA method.
How do I transfer 2FA when switching to a new phone?
The exact method to transfer 2FA when switching to a new phone depends on the specific 2FA you’re using. If you’re getting a new phone number, change the 2FA method on all your accounts before making the switch. Some 2FA options and websites will let you create recovery or backup codes to switch authenticator apps like Microsoft Authenticator from one device to another.
Which 2FA method is most secure for personal use?
Hardware tokens and security keys offer the most secure 2FA method for personal use. They’re not susceptible to interception like SMS codes. Even if someone steals your phone or PC, they won’t be able to get into any accounts secured by a hardware token.
Can I use 2FA without a smartphone?
You can use 2FA without a smartphone, thanks to options like hardware tokens and SMS-based authentication. Additionally, many computers support biometric 2FA through things like Apple’s Face ID and Windows Hello.
