What Is Two-Factor Authentication, and Which Type Should You Use?
What Is Two-Factor Authentication, and Which Type Should You Use?
If you have ever been asked for a code after entering your password, you have used two-factor authentication. Most people know they should use it. Fewer know which type they are using, and almost nobody knows that the type matters — significantly more than most other security decisions.
This guide explains what 2FA actually is, the five types you are likely to encounter, and why they are not equally good. It covers the specific attacks that defeat each type, the practical setup order that reduces the most risk first, and the part almost every article skips: what to do when you lose access to your second factor, because losing a phone is a much more common problem than being hacked.
If you have already set up 2FA on your email, this article will help you check whether it is the right type. If you have not, it explains why the email account is the one to start with.
Key takeaways
- 2FA requires two of three things: something you know, something you have, or something you are.
- The five common types are SMS, authenticator app, push notification, hardware security key, and passkey.
- SMS is the weakest — not because codes are guessable, but because SIM swap lets an attacker receive your codes instead of you.
- Authenticator apps are stronger but still vulnerable to adversary-in-the-middle phishing, where an attacker relays your code in real time.
- Only passkeys and hardware security keys are phishing-resistant, because the credential is bound to a specific domain.
- Save your recovery codes. Losing your second factor without recovery codes is the most common way people get locked out of their own accounts.
1. Why 2FA matters
Passwords fail in two ways. They can be guessed (if weak) or they can be stolen (through a data breach, phishing, or credential reuse). Two-factor authentication addresses the second problem: even if an attacker has your password, they cannot log in without the second factor.
Microsoft has reported that enabling multi-factor authentication blocks the vast majority of account compromise attacks — the figure most commonly cited is 99.9%, though it is worth noting that this comes from Microsoft's own telemetry and the specific methodology is not fully public. The exact number matters less than the pattern: removing the password-only attack path removes most of the ways accounts get compromised in practice.
The practical reason to use 2FA is not that it makes you unhackable. It is that it removes the single most common way accounts get taken over — a stolen or reused password — from the equation. If you have read the earlier guide on creating strong passwords, you will recognise that reusable passwords are the underlying weakness. Two-factor authentication is what makes the weakness much harder to exploit.
However — and this is the point that most 2FA content skips — the type of second factor matters enormously. Some types survive the most common attacks; some do not. The rest of this article is about which is which.
2. The five types, ranked by phishing resistance
The axis that matters is phishing resistance, and it maps to a simple technical property: whether the credential is bound to a specific domain. A code you type by hand is not bound to anything — you can type it into a phishing site, and the site will pass it on to the real service in real time. A credential bound to a domain (a passkey or a hardware key) will only respond if the site is the one it was registered for. This is why those two are the only two that are categorically phishing-resistant.
3. SMS: why it is the weakest
SMS codes are the most common form of 2FA, and also the weakest. The problem is not that the codes themselves are weak — a six-digit code has 1 million possible values and typically expires after a few minutes. The problem is the delivery mechanism.
SIM swap is not a subtle attack. It relies on the carrier's customer service being convinced by an impersonation, which is why the attack works most reliably against people whose personal details are discoverable — public figures, executives, journalists, cryptocurrency holders. For most people, it is not an attack they will face, but it is an attack that is disproportionately damaging when it succeeds, because once the attacker has your number they have every SMS-based second factor for every account at once.
There are two other SMS-specific problems worth knowing. SS7 interception is a technique that exploits weaknesses in the signalling protocol used by telecom networks; it is rare and requires access to carrier infrastructure, but it has been demonstrated. Relay attacks — where an attacker's phishing page forwards your SMS code to the real service in real time — are common and effective, and they are why SMS is not phishing-resistant.
NIST's authentication guidance classifies SMS as a "restricted" authenticator rather than a prohibited one. It is better than a password alone, and it is what most people start with. But it is the weakest of the options available, and the goal is to move off it as better options become available for the accounts that matter.
4. Authenticator apps: better, not perfect
An authenticator app — Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, and others — generates a six-digit code on your device that changes every thirty seconds. The code is derived from a shared secret established when you first set up 2FA on the account, and it cannot be guessed because both sides would need the same secret and the same clock.
This is meaningfully better than SMS for two reasons. The code is not delivered through the phone network, so SIM swap and SS7 interception do not apply. And it works offline — the app does not need a connection, only the correct time, so it works on a plane or in a tunnel.
The reason it is not categorically phishing-resistant is worth understanding, because it is the same reason SMS is not. The code is a six-digit number that you type into a website. A phishing site can present its own login form, capture your password, then show you a "please enter your code" field, capture the code, and use it against the real service in real time. The code expires in thirty seconds, but thirty seconds is ample time for an automated system to relay it.
This technique is called adversary-in-the-middle (AitM) phishing, or real-time relay phishing. It has become dramatically more common since phishing kits began offering it as a turnkey service. The kits proxy the real site, so what the victim sees is indistinguishable from the real thing, and the code is forwarded to the attacker's session in real time.
Push notifications have an additional weakness: MFA fatigue, sometimes called push bombing. If an attacker has your password and sends repeated push approval requests, the user may eventually tap "Approve" out of frustration or confusion. The technique was used in a number of high-profile breaches, including the 2022 Uber incident. Never approve a prompt you did not initiate. If prompts keep arriving, change your password immediately.
5. Passkeys and hardware keys: phishing-resistant
The two options that are categorically phishing-resistant share one property: the credential is bound to a specific domain. When you visit the site the credential was registered for, your device or key responds. When you visit a lookalike site, it does not.
Hardware security keys
A hardware security key — a physical device like a YubiKey — is a small USB or NFC dongle that you plug in or tap to authenticate. When you log in, the site asks the key to prove it holds the credential for that specific domain. The key checks the domain, and if it matches, it signs a challenge. If it does not match, it refuses.
This is why hardware keys are phishing-resistant: a phishing site cannot obtain a valid response from the key, because the key will not respond to the wrong domain. The attack path that works against codes — capture the code, relay it in real time — is simply not available, because there is no code to capture.
The practical downsides are that you need to carry the key with you, and you need to have a backup key in case the primary one is lost. Most services that support hardware keys encourage you to register two — one primary, one stored somewhere safe — so that losing one does not lock you out.
Passkeys
A passkey is the same idea implemented in software rather than hardware. Instead of a physical key, the credential is stored on your device, protected by your fingerprint, face, or device PIN, and synced through your account so it works on multiple devices. When you sign in, your device proves it holds the passkey for that specific domain.
The advantages over a hardware key are significant. There is no separate device to carry, because it is your phone or your laptop. It syncs across devices, so losing one device does not lock you out (as long as you have another signed into the same account). And it replaces the password entirely, not just supplements it — a passkey login has no password step at all.
Passkeys are supported by Google, Apple, Microsoft, and a growing number of banks and services. The FIDO Alliance, which develops the underlying standards, describes them as phishing-resistant — a specific technical claim, not a marketing one. If you have read the earlier guide on what a password manager is, you will recognise that most password managers now store passkeys alongside passwords.
The earlier guide on how to tell if a website is safe covers why the padlock stopped meaning anything. Passkeys are the structural answer to that problem: the credential will not appear on a phishing site, so the fake-login attack is impossible rather than merely less likely.
6. What to set up, in order
The reason for the order is straightforward. Your email account is the reset path for almost every other account you have. If an attacker can access your email, they can trigger password resets for everything else. Protecting the email account with the strongest second factor available therefore protects all the accounts downstream.
The password manager is third because it is the single vault that holds every other credential. If the vault has a strong second factor, an attacker who somehow obtains the master password still cannot access the vault without the second factor. If it does not, the vault's own value is diminished.
Social media and messaging come fourth because the risk is impersonation rather than direct financial loss. An attacker who takes over your account can message your contacts asking for money, post content that damages your reputation, or use your identity to phish the people who trust you. This is a real risk, but it is less catastrophic than losing access to your email or your bank.
7. Recovery codes: the part everyone skips
Every 2FA-enabled account generates a set of recovery codes when you set it up — typically eight to ten single-use codes that you can use if you lose access to your second factor. Most people never save them. This is the single most common way that 2FA creates a problem instead of solving one.
The scenarios where you need them are not theoretical:
- Your phone is lost, stolen, or broken, and the authenticator app is the only place the codes existed.
- You change phone numbers and did not update the recovery phone number first.
- You uninstall the authenticator app without realising it holds the only copy of the code.
- You accidentally wipe the device that had the passkey on it.
When one of those happens, recovery codes are the way back in. If you do not have them, the recovery process is much more involved — typically contacting the service's support, proving your identity in other ways, and waiting. For some accounts, it is impossible.
What to do with recovery codes: when the account offers them, save them. Print them and store them with your master password note. Or save them in your password manager's secure notes (many managers have a dedicated field for this). Do not save them in your email — if your email is compromised, the recovery codes go with it. The paper-and-safe approach is the same as for the master password.
The same principle applies to the second factor itself. If your second factor is an authenticator app, the same app usually lets you export or back up its data — do that. If it is a passkey, your device or account syncs them — verify that sync is working. If it is a hardware key, register two keys and store one somewhere safe.
8. When something goes wrong
"I lost my phone and cannot access my 2FA"
This is the most common problem. The options, in order of how quickly they resolve:
- Recovery codes. If you saved them, use them. This is why they matter.
- The backup device. If you set up 2FA on a second device (an old phone, a tablet, a hardware key), use that. Many people set this up once and forget it exists.
- Another session. If you are still logged in somewhere else, you can often disable or reset 2FA from that session. This is the case where logging out of other devices actively works against you — leaving an "escape hatch" session on a device you trust is a legitimate trade-off.
- Account recovery. Most services have a recovery process. It is usually the slowest option and often requires government ID or a call with support.
"I got a 2FA prompt I did not initiate"
This is serious. It means someone has your password and is trying to log in. Do the following immediately:
- Do not approve the prompt. Tap "deny" if that is an option.
- Change your password on the affected account.
- Sign out of all sessions.
- Check your recovery settings for anything you did not add.
- Enable a stronger second factor — a passkey or hardware key — if available.
"My carrier offered me a SIM lock — should I use it?"
Yes, if it is available. A SIM lock requires a PIN to perform a SIM change or number port, which closes the most common path for the SIM swap attack. It is not a substitute for moving away from SMS 2FA, but it is a useful additional protection that costs nothing. Ask your carrier whether they offer it.
Some carriers also offer a "port freeze" or "port-out PIN" that prevents your number being moved to another carrier without your consent. The specific mechanism varies by country and carrier; the point is to ask, because these protections are often not enabled by default.
"I want to switch from SMS to something better"
For the accounts that support it, the change is usually in the security or two-factor settings. Most services let you add a new factor and then remove the old one. The safe sequence:
- Add the new second factor (app, passkey, hardware key).
- Verify it works by logging in on another device.
- Only then remove SMS as a factor.
Removing SMS first is a common mistake and can lock you out if the new factor turns out to have a problem. The order matters.
Where this leaves you
Two-factor authentication is not a single thing. It is a category of methods, and the differences between them matter more than most security decisions. SMS is meaningfully weaker than an authenticator app, which is meaningfully weaker than a passkey. The reason is phishing resistance, and it comes down to a simple technical property: whether the credential is bound to a specific domain.
The practical path is to start where you are. If you use SMS only, add an authenticator app to the accounts that support it and keep SMS as a fallback. If you have an authenticator app already, add a passkey to the accounts that offer it — Google, Apple and Microsoft all do, and banks are catching up. The goal is not to be at the strongest level immediately; it is to be moving in that direction.
And save your recovery codes. The most common failure mode of 2FA is not being hacked — it is being locked out of your own account because the phone that held the second factor was lost, and the recovery codes were never saved. That is a preventable problem, and preventing it costs about two minutes.
Frequently asked questions
Is two-factor authentication worth it?
Yes, in almost every case. It removes the most common attack path — a stolen or reused password — from the equation. The main caveat is that the type matters: SMS is the weakest option, and passkeys or hardware keys are the strongest. But even SMS is meaningfully better than a password alone.
Which type of 2FA is the most secure?
Passkeys and hardware security keys are the most secure, because they are phishing-resistant — the credential is bound to a specific domain, so it will not respond to a lookalike site. Authenticator apps are the next strongest, then push notifications, then SMS.
Is SMS 2FA better than nothing?
Yes. It is meaningfully better than a password alone, and it blocks most account compromise attacks. The specific attacks it does not block — SIM swap, SS7 interception, real-time relay phishing — are serious but require more effort than the attacks that 2FA with any type blocks. Use SMS if it is all that is offered, but upgrade when you can.
What happens if I lose my phone?
If you saved your recovery codes, use them. If you set up 2FA on a second device, use that. If you are still logged in somewhere, disable 2FA from that session. If none of those apply, the recovery process depends on the service — most offer a way back in, but it can take days and may require identity verification.
Can someone bypass 2FA?
Yes, in specific circumstances. SIM swap defeats SMS. Adversary-in-the-middle phishing defeats SMS, authenticator apps, and push notifications. MFA fatigue defeats push notifications if the user approves a prompt they did not initiate. Passkeys and hardware keys are not bypassable by these techniques because the credential is bound to a domain — but they can be defeated by malware on the device itself, which is why endpoint security still matters.
Should I use an authenticator app or SMS?
An authenticator app, if the service supports it. It is meaningfully stronger — not delivered through the phone network, so SIM swap does not apply, and it works offline. Use SMS as a fallback for accounts that do not support an app, or as a backup factor when you are setting up the app.
What is the difference between 2FA and MFA?
They are often used interchangeably. Technically, two-factor authentication means two factors; multi-factor authentication means two or more. In practice, most services call their offering "2FA" or "MFA" and mean the same thing: an extra step beyond the password.
Is a passkey the same as 2FA?
A passkey can function as both factors at once, because it combines something you have (the device) with something you are (the fingerprint or face that unlocks it). In practice, passkeys are usually described as a replacement for passwords rather than as a second factor, because there is no password to begin with. They are the strongest form of authentication currently widely available.
A note on accuracy: the Microsoft figure about MFA blocking "99.9%" of account compromise attacks is widely cited and comes from Microsoft's own published research. It is presented in this article with appropriate attribution rather than as an established universal fact — the exact figure depends on Microsoft's methodology and telemetry, and independent studies may produce different numbers. The underlying claim, that MFA removes most account compromise, is consistent across sources.
Sources and further reading: NIST Special Publication 800-63B (Digital Identity Guidelines — Authentication and Lifecycle Management), including its classification of SMS as a "restricted" authenticator; FIDO Alliance documentation on FIDO2, WebAuthn, and passkeys; Microsoft's public research on multi-factor authentication and account compromise statistics; CISA guidance on phishing-resistant MFA; FCC rules and consumer guidance on SIM swap protection; public statements from Google, Apple and Microsoft on passkey support; reporting on the 2022 Uber incident (MFA fatigue as an initial access vector).