How Two-Factor Authentication Protects Your Accounts

Every year, billions of usernames and passwords leak from hacked websites. Criminals collect them and try them automatically on email, banking, shopping and social media accounts, hoping people have reused the same password. Many have.

Two-factor authentication is one of the simplest ways to make a stolen password useless on its own.

What “two factors” means

Security experts group the ways of proving who you are into three types, called factors:

• Something you know: a password or PIN
• Something you have: your phone, or a physical security key
• Something you are: your fingerprint or face

Two-factor authentication, often called 2FA or multi-factor authentication (MFA), means using two different types together. A password plus a code sent to your phone counts. Two passwords don’t, because they are both something you know.

The idea is simple: an attacker who has stolen your password still needs your phone or key, which they almost never have.

A stolen password on its own is no longer enough.

How well does it work?

Very well, even in its simplest forms. In 2019, Google researchers published a study of how different second factors performed against attacks on Google accounts:

Microsoft has reported similar findings, saying that accounts using multi-factor authentication are far less likely to be compromised.

The main methods, from weakest to strongest

Text-message (SMS) codes

The website texts you a short code to type in. It’s much better than nothing and very easy to use. But it has weaknesses: criminals can trick a mobile operator into moving your number to their SIM card (a SIM swap), and they can trick you into reading out the code on a phishing site or over the phone.

Authenticator app codes

Apps such as Google Authenticator, Microsoft Authenticator and many password managers show a six-digit code that changes every 30 seconds. When you set it up, the website and the app share a secret. Each code is then worked out from that secret and the current time, so the app doesn’t need a signal or internet connection. This avoids SIM swaps, but a well-made fake website can still trick you into typing the code.

Sign-in prompts on your phone

Some services, such as Google and Microsoft, send a prompt to your phone asking “Are you trying to sign in?” You tap yes or no, sometimes matching a number shown on screen. This is convenient and stronger than codes. Be careful of “prompt bombing”, where attackers who already have your password send prompt after prompt, hoping you’ll tap yes to make them stop. If you get a prompt you didn’t expect, deny it and change your password.

Passkeys and security keys

Hardware security keys are small USB, NFC or Bluetooth devices that you plug in or tap. Passkeys work in the same way but are stored on your phone or computer. Both use public-key cryptography and are tied to the real website’s address, so they can’t be phished. These are the strongest options available to most people. See how passkeys work.

Setting it up

1. Start with your most important accounts: your main email (it’s used to reset everything else), your bank, your phone’s account (Apple, Google or Microsoft), and social media.
2. Look in security settings for “two-step verification”, “two-factor authentication” or “sign-in options”.
3. Choose the strongest option offered that you’re comfortable with: a passkey or security key, then an authenticator app or prompt, then text messages.
4. Save your backup codes. Most services give you a set of one-time recovery codes. Print them or store them in a password manager, so you can get in if you lose your phone.

Staying safe with codes

• Never share a code with anyone. No genuine company, bank or support team will ask you to read it out.
• Check the website address before entering a code.
• Deny prompts you didn’t start.
• Keep your phone locked with a PIN or biometrics, so that someone who picks it up can’t see your codes.