Two-factor authentication explained

Two-factor authentication explained

Normally you prove who you are with one thing: your password. Two-factor authentication (2FA) adds a second, different kind of proof. The factors are usually grouped as:

• Something you know: a password or PIN.
• Something you have: your phone, an authenticator app or a security key.
• Something you are: a fingerprint or face scan, usually used to unlock the phone or key.

With 2FA on, someone who steals or guesses your password still can't log in, because they don't have your second factor.

2FA explained: why it matters

Passwords leak all the time: through data breaches at other websites, phishing pages and malware. Attackers then try those passwords automatically against email, banking and business accounts. 2FA breaks that chain. It's especially important for your email, because email is how most other accounts are reset.

Multi-factor authentication explained: 2FA vs MFA

Multi-factor authentication (MFA) means using two or more factors. Two-factor authentication is the most common form of MFA. Services also call it two-step verification, login verification or similar. For everyday purposes they all mean the same thing: a second step after your password.

Types of two-factor authentication: pros and cons

• Authenticator app (codes that change every 30 seconds): free, works offline, much safer than SMS. A good default for most accounts.
• SMS codes: easy and better than nothing, but texts can be intercepted, and attackers can trick a phone company into moving your number to their SIM card (SIM swapping). Use another option where you can.
• Push notifications ("Is this you trying to sign in?"): convenient, but attackers sometimes send many requests hoping you'll approve one by mistake. Only approve a request you started yourself. Prompts that ask you to type a number shown on screen are safer.
• Security keys (a small USB or NFC device): the strongest option. They resist phishing because the key checks it's talking to the real website.
• Passkeys: a newer way to log in without a password, using your phone or computer's screen lock. Passkeys are also phishing-resistant and increasingly supported by big services.

How to turn on two-factor authentication

The exact menus differ, but the steps are nearly always the same:

1. 1Log in and open the account's security or sign-in settings.
2. 2Find two-factor authentication, two-step verification or passkeys, and choose to turn it on.
3. 3Pick a method. For an authenticator app, scan the QR code shown on screen with the app.
4. 4Enter the code the app shows to confirm it works.
5. 5Save the backup codes you're offered (see below).

Backup codes: don't skip this step

Backup or recovery codes are one-time codes that let you in if you lose your second factor. Print them or store them in your password manager, somewhere you can reach even if your phone is gone. Without them, recovering an account can take days.

What happens if I lose my phone?

• Use a backup code to log in, then remove the old phone and set up 2FA on your new one.
• Many authenticator apps can back up or sync codes to a new phone. Check that this is switched on before you need it.
• Add a second method where possible, such as a second security key or a backup phone number.
• If you're locked out with no backup, use the service's official account recovery process. It's slower, but it works.

Never share your 2FA code

Attackers know 2FA stops them, so they try to get the code from you. A typical trick is a call or message from "your bank" or "the support team" saying a code is about to arrive and asking you to read it out to confirm your identity.

A 2FA code is only for typing into the real website or app yourself. No genuine company will ever ask you to tell them a code. If someone does, it's a scam: hang up, and if you shared a code, change your password straight away.

Rolling out 2FA in a small organisation

1. 1Start with the accounts that give the most access: email, the password manager, banking and the website admin.
2. 2Pick one method for everyone where you can, such as an authenticator app, so people can help each other.
3. 3Set aside half an hour to set it up together, and make sure everyone saves their backup codes.
4. 4Decide who to contact if someone loses their phone, and write it down.
5. 5If your email or office software allows it, make 2FA required for all accounts, not just recommended.

Where to turn on 2FA first

1. 1Your email accounts, because they can reset everything else.
2. 2Your password manager.
3. 3Banking, payment and payroll services.
4. 4Your website, hosting and domain registrar accounts.
5. 5Social media accounts, especially your organisation's.

Pair 2FA with long, unique passwords. Our guide on how to create a strong password shows how.