Two-Factor Authentication: Why You Need It

Passwords alone provide single-factor authentication: something you know. If that password is stolen — through phishing, data breach, or keylogging — an attacker can access your account from anywhere in the world. Two-factor authentication adds a second layer: something you have (a phone, hardware key) or something you are (fingerprint, face). Even with your password, an attacker without the second factor cannot log in. This single addition eliminates the majority of account takeover attacks.

SMS 2FA sends a code to your phone via text message. It's better than nothing but the weakest form of 2FA — phone numbers can be ported to attacker-controlled SIMs through social engineering (SIM swapping), and SMS codes can be intercepted. Authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) generate time-based one-time passwords (TOTP) locally on your device without network transmission, making them significantly more secure. Hardware security keys (YubiKey, Google Titan) are the most secure option, using cryptographic challenges that cannot be phished.

Prioritise these accounts for 2FA immediately: email (used to reset all other passwords — your most critical account), banking and financial services, work accounts and VPNs, social media (especially large followings or linked business accounts), and cryptocurrency wallets. Most major services offer 2FA in security settings — look for 'two-step verification,' '2-step verification,' or 'authenticator app' options. Use an authenticator app rather than SMS wherever both are offered.

When setting up 2FA, most services provide backup codes — single-use emergency codes for when you don't have access to your second factor. Store these codes securely: print them and store physically, or save to an encrypted password manager vault. Never photograph backup codes with your phone's camera roll as this defeats their purpose if your phone is compromised. Losing access to your 2FA method without backup codes can result in permanent account lockout, so backup code storage is critical.

Standard TOTP codes from authenticator apps can still be phished — a sophisticated attacker can trick you into entering your code on a fake site that simultaneously logs in to the real site. Hardware security keys using FIDO2/WebAuthn are phishing-resistant because authentication is cryptographically tied to the website domain — a fake site's domain won't match, and the key won't authenticate. For high-value accounts managing sensitive data or significant finances, a hardware key is a worthwhile investment at $30–50.