Two-Factor Authentication

Authentication factors are usually grouped into three types: something you know, such as a password or PIN; something you have, such as a phone, card or security key; and something you are, such as a fingerprint or face.

Two-factor authentication combines two of these types. For example, a customer logging into online banking might enter their password and then a one-time code sent to their phone or generated by an authentication app.

Because an attacker would need both factors, 2FA greatly reduces the risk of account takeover, even if a password is stolen. It is a form of multi-factor authentication, which can involve two or more factors.

In the European Union and United Kingdom, strong customer authentication rules under payment regulations require two-factor checks for many online payments and account access.

Not all methods are equally secure. Codes sent by text message can be intercepted through SIM swap fraud, where criminals take control of a victim’s phone number. Authentication apps, security keys and passkeys are generally more secure. Fraudsters also try to trick people into revealing codes, so customers should never share them.