Two-Factor Authentication & Passkeys
Two-factor authentication (2FA, also called multi-factor authentication or MFA) means logging in takes something you know (your password) plus something you have (your phone or a key). Even if a criminal steals your password, they can’t get in without the second factor. It’s one of the most effective things you can do.
- Everyone
- Workers
- Small businesses
Types, from good to best
| Type | How it works | Notes |
|---|---|---|
| Text message (SMS) code | A code is texted to your phone | Much better than nothing, but can be stolen through SIM swapping or phishing |
| Authenticator app | An app makes a new code every 30 seconds | Stronger than text codes; works without cell signal |
| Push approval | Your phone asks “Is this you?” | Easy, but beware of fake requests (see below) |
| Security key | A small USB or NFC key you tap | Very strong; resists phishing |
| Passkey | Your phone or computer signs you in with your fingerprint, face or PIN | Replaces the password; resists phishing; increasingly common |
Turn it on first for
- Email accounts
- Banking, payroll and payment apps
- Your phone carrier account (also add a carrier PIN; see Smartphone Security)
- Your password manager
- Social media and work accounts
Look in each account’s security settings for “two-step verification,” “2FA,” “MFA” or “passkeys.”
Never share your codes
No real bank, employer, delivery company or tech support will ever ask you to read back a code you received. If someone asks for a code, they are trying to get into your account. Hang up.
MFA fatigue attacks
Some criminals who have your password trigger dozens of push approval requests, hoping you’ll tap “Approve” to make them stop. If you get a login prompt you didn’t start, deny it and change your password right away. It means someone has your password.
Don’t get locked out
- Save the backup or recovery codes each account gives you, in your password manager or a printed copy kept safe.
- Add a second method (like a backup phone or second key) where allowed.
- Before getting a new phone, move your authenticator app accounts over.
Standards & references
Last updated: