Your password is fine. That's the problem — it's fine right up until a stranger types it into a login page from another country at 3am while you're asleep. Two-factor authentication exists for that moment. It demands a second, different kind of proof before anyone gets in: something you have, or something you are, on top of something you know. The catch is that not all second factors are equal. A texted code and a hardware key both count as 2FA, yet one can be talked out of you over the phone and the other shuts down most phishing pages outright. Here's how to tell them apart.
What actually counts as a second factor
Authentication factors fall into three groups: something you know (a password or PIN), something you have (a phone, an app, a key), and something you are (a fingerprint, your face). Real two-factor authentication combines two different groups.
That distinction matters more than it sounds. A password plus a security question is not 2FA — it's two secrets living in the same place, so one good breach spills both. Neither is "your password and then your other password."
Worth setting expectations honestly: 2FA stops credential stuffing, password reuse fallout and most remote account takeovers. It doesn't stop malware already running on your device, and it doesn't save you if you hand over a live session yourself.
SMS codes: convenient, and the weakest of the three
Texted codes work on any phone, need no setup and feel familiar to almost everyone. That is genuinely valuable, and for plenty of services it's the only option offered. The weakness sits in the phone number itself.
- SIM swapping and port-out fraud. Someone convinces your carrier to move your number to their SIM, and every code now lands on their device.
- Network interception. Text messages were never designed as a secure channel, and flaws in older mobile signalling protocols have been demonstrated for years.
- Malware. Apps with SMS permissions can read incoming codes on an infected Android phone.
- You. The most common attack is a calm caller claiming to be IT support, asking you to read out "the code we just sent."
If SMS is your only choice, add a PIN or passphrase to your carrier account, ask about a port freeze, and treat any request for a code — from anyone, ever — as fraud.
Use it as a stepping stone, not a destination, especially on email and banking.
Authenticator apps: the sensible default
Apps like Google Authenticator, Microsoft Authenticator, Aegis, 1Password and similar generate a fresh six-digit code every 30 seconds from a shared secret set up when you enroll. No signal required, no phone number involved, and a SIM swap gets an attacker nowhere.
The remaining gap is phishing. A convincing fake login page can ask for your code and relay it to the real site within the 30-second window. Rare, but real. So app codes are far better than SMS and still not phishing-proof.
Backups decide whether this works
Losing your phone should be annoying, not catastrophic. Two approaches exist: apps that sync your secrets to a cloud account, and apps that keep everything on the device only. Syncing is easier to recover; device-only is harder to steal remotely. Whichever you pick, do these:
- Save the backup or recovery codes each service shows you, and store them somewhere offline.
- Register a second device or a second method where the service allows it.
- Confirm you can still get in from a different device before you remove your old method.
Hardware security keys: strongest, with real trade-offs
A physical key — a small USB or NFC device you tap or plug in — uses the FIDO2/WebAuthn standard. When you sign in, the key verifies that the site asking is genuinely the site you think it is, because the cryptographic handshake is bound to that domain. A lookalike page simply fails. This is what "phishing-resistant" means in practice, not marketing.
Buy two and register both on every account. Keep the spare somewhere separate from your main keyring. The trade-offs are honest ones: not every service supports them, they cost money, and if you lose your only key and your recovery codes, you're locked out.
Where do keys earn their keep? Your email account, your password manager, your bank, and any cloud or hosting account that could be used to reset everything else.
Push approvals and passkeys
Tap-to-approve push notifications are convenient but vulnerable to prompt fatigue: an attacker with your password spams login requests until you tap Approve by reflex. If your service offers number matching, use it — only approve when the number on screen matches the one you're looking at.
Passkeys build on the same standard as hardware keys but store the credential in your device's keychain or password manager, unlocked by your fingerprint or face. They're fast and phishing-resistant. The caveat is dependency: your Apple, Google or Microsoft account, or your password manager, becomes the thing holding the keys. Protect that account with a hardware key.
Which one should you use?
- Turn on app-based 2FA for your email today. Email resets everything else, so it's the highest-value account you own.
- Protect your password manager with an app code at minimum, ideally a security key.
- Use hardware keys for email, banking and anything with admin access.
- Keep SMS only where nothing better exists — and lock down your carrier account if you do.
- Accept push notifications as a decent middle ground, with number matching enabled.
Set it up without locking yourself out
Do the boring parts now. Print your recovery codes and keep them with your passport or in a fireproof box rather than in a notes app on the same phone you're protecting. Add a second factor before you remove the first, then test the whole chain in a private browsing window so you know it works. Set a yearly reminder to review which accounts still rely on SMS and whether your phone number is still listed as a recovery option.
For bank and investment accounts specifically, ask your provider which methods they support and how their recovery process works — a support phone call is part of your security setup whether you planned for it or not. Ten minutes of setup buys you a login that a stolen password alone can't open.
Photo: geralt / Pixabay