What Is Two-Factor Authentication, and Which Type Should You Use?

The short version: Two-factor authentication means proving who you are with two different kinds of evidence, drawn from three categories: something you know, something you have, and something you are. Any second factor is a large improvement over a password alone, but the common ones are not close to equivalent. Google research published in May 2019 found that a code sent by text message blocked 76 percent of targeted attacks while an on-device prompt blocked 90 percent, and that no user relying solely on a security key was successfully phished during the study period. The National Institute of Standards and Technology, in Special Publication 800-63B-4 of 31 July 2025, classes text-message and voice delivery as a restricted authenticator. The categorical break is between factors an attacker can relay through a fake login page and factors that are bound to the real website’s address and therefore cannot be relayed at all. Turn something on for your main email account today, and prefer a passkey or a security key where one is offered.

What the factors actually are

The three categories are worth stating precisely, because most confusion here is definitional. Something you know is a secret in your head: a password, a PIN, an answer to a security question. Something you have is a physical object you possess: a phone, a hardware key, a smart card. Something you are is a biometric: a fingerprint, a face, an iris.

Two-factor authentication requires two of those three categories, not two steps. A password plus a security question is not two-factor authentication; it is two things you know, and an attacker who has phished one has usually phished the other. A fingerprint used to unlock an authenticator app is not a separate factor being sent to the website either; it is a local check that releases the key stored on the device. What crosses the network is still the possession factor.

The phrase multi-factor authentication, or MFA, means the same thing with the door left open for three factors or more. In consumer settings the two terms are used interchangeably and nothing turns on the distinction.

Ranking the second factors by what they stop

Three attacks do most of the damage, and they behave very differently against each factor. Credential stuffing is automated reuse of passwords leaked from other breaches; every second factor defeats it. Real-time phishing, sometimes called adversary-in-the-middle, is a fake login page that relays whatever you type straight to the real site, including your one-time code, within its validity window; most second factors do not stop it. Account recovery abuse is persuading the provider or a help desk to hand over the account without the factor at all.

The pattern in that table is the whole subject. Every row defeats the bulk automated attacks. Only the bottom two defeat a competent human attacker who has put a convincing fake page in front of you.

SMS, SIM swapping, and why NIST has narrowed its guidance

A text message is delivered to a phone number, and a phone number is an account at a mobile carrier that a person at that carrier can move to a different SIM. SIM swapping exploits exactly that. The Federal Bureau of Investigation’s Internet Crime Complaint Center, in a public service announcement of 8 February 2022, reported 320 SIM-swapping complaints with adjusted losses of about $12 million across the whole of 2018 to 2020, against 1,611 complaints and more than $68 million in losses in 2021 alone.

The Federal Communications Commission responded with a Report and Order, FCC 23-95 in WC Docket 21-341, adopted on 15 November 2023, requiring wireless carriers to authenticate customers securely before processing a SIM change or a number port-out, to notify customers immediately of such requests, and to offer account locks at no cost.

NIST’s position has tightened accordingly. Special Publication 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, published 31 July 2025, treats use of the public switched telephone network for out-of-band authentication as restricted. Verifiers that use it must ensure alternative authenticator types are available to all subscribers, should consider risk indicators such as a device swap, a SIM change or a number port, and should remind subscribers of the limitation. The Cybersecurity and Infrastructure Security Agency, in its October 2022 fact sheet Implementing Phishing-Resistant MFA, is blunter, describing SMS and voice as vulnerable to phishing, to attacks on the SS7 signalling protocol and to SIM swap, and stating they should be used only as a last resort.

None of that makes SMS worthless. Against an automated password-reuse attack it works, and it is enormously better than nothing. It is simply the weakest rung.

Push approval and MFA fatigue

A push prompt that asks only “approve or deny” has an obvious failure mode. An attacker holding your password can trigger the prompt repeatedly, at two in the morning, until you tap accept to make it stop. This is variously called MFA fatigue, push bombing or MFA bombing, and it was the technique behind several widely reported corporate intrusions in 2022. CISA’s October 2022 fact sheet identifies push notifications without number matching as vulnerable to push bombing and to plain user error.

The mitigation is number matching: the login screen displays a two-digit or three-digit number and you must type it into the app. An attacker who is not looking at your screen cannot tell you what to enter. Microsoft removed the ability to disable this and enforced number matching across Microsoft Authenticator from 8 May 2023.

Phishing resistance, and why FIDO2 is a different category

Every factor above the bottom two shares one weakness: the secret can be relayed. If you can read a six-digit code and type it into a box, you can be persuaded to type it into the wrong box, and a relay proxy will forward it to the real site before it expires.

WebAuthn breaks that chain by removing the human from the transfer. Published by the World Wide Web Consortium as a Recommendation at Level 1 on 4 March 2019 and at Level 2 on 8 April 2021, and paired with the FIDO Alliance’s Client to Authenticator Protocol to form FIDO2, it works by public-key cryptography with one crucial addition: the credential is registered against a specific relying party identifier, meaning the site’s real domain. The browser passes the origin it is actually talking to, and the authenticator will only sign for credentials registered to that origin. On a look-alike domain, there is nothing to offer. No code exists that a user could be tricked into reading aloud. The attack fails because of the protocol, not because the user noticed something.

Passkeys are WebAuthn credentials with the usability problems solved: created with a fingerprint or face check, synced across your devices through a platform account. They inherit the phishing resistance. NIST does draw one line, specifying in 800-63B-4 that syncable authenticators, whose private keys are by design exportable to the sync fabric, shall not be used at the highest assurance level, AAL3, which requires hardware-bound keys. For consumer accounts that distinction rarely bites; for a high-value account it is the argument for a physical security key.

The misconception worth correcting

The belief to abandon is that turning on two-factor authentication makes an account unphishable. It does not. It makes the account resistant to the theft of a password on its own, which is a different and much narrower claim.

The Google study published on 17 May 2019 by Kurt Thomas and Angelika Moscicki, with researchers at New York University and the University of California San Diego, put numbers on it. A code sent to a recovery phone stopped 100 percent of automated bots, 96 percent of bulk phishing and 76 percent of targeted attacks. An on-device prompt stopped 100 percent, 99 percent and 90 percent respectively. Roughly one targeted attack in four got through SMS-based 2FA, and one in ten got through push prompts. Only among users relying exclusively on security keys did the researchers find nobody successfully phished.

So the correct mental model is not a locked door. It is a filter that removes almost all the automated volume and a good deal, but not all, of the targeted attention.

Recovery codes and the real weak link

Every 2FA system needs an answer to losing the phone, and that answer is where the security of the whole arrangement is usually decided. If an attacker can talk a help desk into resetting your second factor, or can answer a security question sourced from a data broker, the strength of the factor itself becomes irrelevant. Social engineering of support staff has been a repeated feature of major intrusions.

Practically, this means three things. Download the backup or recovery codes when you enable 2FA, and store them where you store other valuables, offline and not in the same place as the password. Register a second factor rather than relying on one, for example two security keys, or a passkey on two devices. And look at what the account will accept as proof if you say you are locked out: if the answer is a text message to your phone number, you have an SMS-strength account whatever else you turned on.

What to turn on first

Secure in this order: the email account that can reset everything else, then your mobile carrier account, then your password manager, then banking and brokerage, then everything else. The ordering follows from blast radius rather than from the value of what is inside. An email inbox is the recovery route for most of your other accounts, so it is worth more to an attacker than almost anything it contains.

Within each account, take the strongest factor offered and do not overthink the rest. If passkeys or a security key are available, use them. If not, a TOTP authenticator app is the next rung, and push with number matching is comparable. SMS sits at the bottom, and still beats leaving it off. Add a carrier PIN or port-out lock on your mobile account while you are there, since the FCC order requires carriers to offer it without charge.

Where these figures come from

Authentication requirements and the restricted status of telephone-network delivery are from the National Institute of Standards and Technology, Special Publication 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, published 31 July 2025. Guidance on phishing-resistant methods, number matching and push bombing is from the Cybersecurity and Infrastructure Security Agency fact sheet Implementing Phishing-Resistant MFA, October 2022. SIM-swap complaint and loss figures are from the Federal Bureau of Investigation Internet Crime Complaint Center public service announcement of 8 February 2022. Carrier obligations are from the Federal Communications Commission Report and Order FCC 23-95 in WC Docket 21-341, adopted 15 November 2023. Effectiveness percentages are from Google research by Kurt Thomas and Angelika Moscicki with New York University and the University of California San Diego, published on the Google Security Blog on 17 May 2019. WebAuthn publication dates are from the World Wide Web Consortium, Level 1 of 4 March 2019 and Level 2 of 8 April 2021. The number-matching enforcement date is Microsoft’s own, 8 May 2023.

General information, current as of September 2026, and not personalised advice.