Two-factor authentication is a login method that asks you to prove who you are in two different ways instead of one, so that a stolen password alone is not enough to open your account. The first factor is usually something you know, your password. The second is something you have, such as a code from an app on your phone, or something you are, such as a fingerprint. Because an attacker would need to defeat both, two-factor authentication turns a leaked password from a disaster into a near miss. This explainer from newsreverse com walks through how it works, which methods are strong and which are weak, and how to switch it on without locking yourself out.
Why is a password on its own not enough?
Passwords fail in predictable ways. People reuse the same one across many sites, so a breach on a minor forum can hand over the keys to your email and bank. Passwords get phished through fake login pages, guessed when they are weak, and exposed in large data leaks. Once a password is out, anyone who has it can walk straight in. A second factor breaks that chain. Even if a criminal buys your password on the dark web, they still cannot pass the second check without physical access to your phone or key. That is the whole point: it adds a barrier that a remote attacker with only your password cannot cross.
How does two-factor authentication actually work?
The flow is simple from the user’s side. You enter your username and password as usual, and then the service asks for a second proof. That might be a six-digit code you read from an app, a prompt you approve on your phone, a tap on a small hardware key, or a fingerprint or face scan. Only after both steps succeed are you let in.
Security professionals group the possible factors into three families, and true two-factor authentication combines two different families rather than two of the same kind:
- Something you know — a password or PIN.
- Something you have — your phone, an authenticator app, or a hardware security key.
- Something you are — a fingerprint, face or other biometric.
A password plus a security question is not really two-factor, because both are things you know. A password plus a code from your phone is, because it mixes knowledge with possession.
Which two-factor authentication method is the most secure?
Not all second factors are equal. Some can be stolen remotely; others are bound to your physical device and to the exact website you are visiting, which makes them extremely hard to trick. The table below ranks the common methods from strongest to weakest.
| Method | Strength | Main weakness |
|---|---|---|
| Passkey / hardware security key (FIDO2) | Strongest | Needs a compatible device; key can be lost |
| Authenticator app code (TOTP) | Strong | Phone loss without backup codes; advanced real-time phishing |
| Push approval prompt | Good | Users may approve by reflex (“prompt bombing”) |
| SMS one-time code | Basic | SIM-swap fraud; codes relayed by phishing proxies |
| Email one-time code | Weakest | Only as safe as the email account itself |
A time-based one-time password, or TOTP, is the familiar six-digit code that refreshes every 30 seconds inside apps like Google Authenticator, Microsoft Authenticator or Authy. It is generated on your device from a shared secret and the current time, so it works even with no signal and cannot be diverted by a SIM swap. That makes it far safer than SMS while remaining easy to use.
Passkeys and hardware keys go a step further. They use public-key cryptography that is tied to the specific website domain that created them. A lookalike phishing site simply cannot request a valid signature, which is why these methods are described as phishing-resistant. For your email, bank and primary accounts, they are the gold standard.
Are SMS codes safe enough?
SMS-based codes are better than nothing, and for many everyday accounts they are a reasonable minimum. But they carry a real weakness. In a SIM-swap attack, a fraudster convinces a mobile operator to move your number to a SIM card they control, after which your one-time codes arrive on their phone. Attackers can also run real-time phishing pages that capture your password and your SMS code at the same instant and replay them within seconds. For that reason, security agencies advise moving your most sensitive accounts to an authenticator app or a passkey, and keeping SMS only as a fallback. If you have nothing else enabled, SMS 2FA is still a worthwhile step up from a bare password.
What are passkeys, and should you switch?
Passkeys are a newer standard, promoted by the FIDO Alliance and now supported by major platforms, that aims to replace passwords entirely. Instead of a secret you type, your device holds a private cryptographic key and unlocks it with your fingerprint, face or device PIN. Because nothing you enter can be phished or intercepted, passkeys resist the attacks that defeat passwords and SMS codes alike. If a service you rely on offers passkeys, enabling one for that account is one of the strongest single upgrades you can make to your online safety. You can still keep a password and a backup method in place while you get comfortable with them.
What are the common ways attackers try to defeat 2FA?
Two-factor authentication raises the bar dramatically, but it is worth knowing the tricks criminals use, because awareness is what keeps the weaker methods from failing you. The main attacks are:
- SIM swapping. A fraudster persuades your mobile operator to transfer your number to a SIM they hold, after which your SMS codes arrive on their device. This is the biggest weakness of SMS-based 2FA.
- Real-time phishing. A fake login page relays your password and your one-time code to the real site the instant you type them, logging the attacker in before the code expires. App and SMS codes are both vulnerable to this; passkeys and hardware keys are not.
- Prompt bombing. Where push approvals are used, an attacker who already has your password floods you with approval requests, hoping you tap “yes” out of habit or annoyance. The fix is never to approve a prompt you did not trigger.
- Malware and lock-screen theft. Codes shown on a locked screen can be read by someone holding your phone, and malware can scrape them. Hide notification contents on the lock screen for sensitive apps.
The pattern is clear: the methods that require you to type or approve something can, in principle, be tricked, while cryptographic methods bound to the real website cannot. That is the case for moving critical accounts to passkeys or hardware keys, and for treating any unexpected code or prompt as a warning rather than a routine.
How do I turn on two-factor authentication?
The steps are similar across most services, and the whole process usually takes a few minutes per account:
- Open the account’s security or login settings and find the two-factor or two-step verification option.
- Choose an authenticator app or a passkey if offered, rather than SMS, for your important accounts.
- For an app, scan the QR code the service displays; your authenticator will start generating codes immediately.
- Enter one code to confirm the setup worked.
- Save your backup codes. Every good service gives you a set of one-time recovery codes. Store them offline, because they are your way back in if you lose your phone.
Prioritise the accounts that would hurt most if lost: your primary email first, because it can reset everything else, then banking and payments, then social media and cloud storage. It is also worth reviewing 2FA settings once or twice a year, since services regularly add stronger options such as passkeys that were not available when you first signed up. If you change your phone number or replace your device, update your second-factor settings before you let the old one go, so you never find yourself locked out with codes arriving on a number you no longer control.
Where does 2FA fit into staying safe online?
Two-factor authentication is powerful, but it is one layer among several. It works best alongside strong, unique passwords, a password manager, and a healthy suspicion of unexpected links. It also pairs naturally with knowing how to recognise manipulated media and secure connections. If you want to build that wider habit, our guides on how to spot a deepfake video and the difference between HTTP and HTTPS cover the everyday skills that go with strong logins, and you can find more in our technology section.
In India, most people already use two-factor authentication without naming it. The Reserve Bank of India requires an additional factor of authentication for card transactions, which is why an OTP lands on your phone before an online payment clears. Extending that same second-factor habit to your email, social accounts and cloud storage closes the gap that criminals exploit most often. And if an account is compromised despite your precautions, you can report the fraud on the National Cyber Crime Reporting Portal or by calling the helpline 1930.
The core idea is worth repeating because it is so effective. A password can be stolen from far away. A second factor, especially a phishing-resistant one, forces an attacker to get past something they do not have. Turning it on is a few minutes of effort that quietly defends you every time you log in.