You are paying a bill, your phone buzzes with a six-digit code, and you type it into the bank's website. That small interruption is doing more for your security than any clever password you have ever invented. It is also, depending on which kind of code arrives, either a sturdy lock or a fairly thin one.
Two-factor authentication means proving two separate things when you sign in: something you know, like a password, and something you have or are, like a code, an app, or a physical key. Accounts set up this way survive most password leaks, because a stolen password alone is no longer enough to get in. The method you pick decides how much of that protection you actually receive.
What 2FA Does and Does Not Stop
Most account break-ins start with credentials that were reused somewhere else and dumped in a breach. A second factor stops that cold. It also blunts ordinary phishing, because a stolen password without the second step is useless.
What it does not stop: a convincing fake login page that asks for your code in real time and passes it along; malware already running on your device; or someone who has your unlocked phone in hand. Those attacks exist, and they are exactly why the type of second factor matters. Stronger factors are harder to relay, harder to copy, and harder to talk out of you.
SMS Codes: The Default Everyone Already Has
Text message codes are the reason 2FA spread at all. Nothing to install, nothing to buy, works on a ten-year-old phone, and every service on earth supports it. If your only options are SMS or nothing, take SMS.
The weaknesses are real, though. Phone numbers can be hijacked through a SIM swap, where someone convinces your carrier to move your number to their SIM. Codes can also be read by malware on an infected phone, or intercepted through weaknesses in the older signalling networks carriers still rely on. None of this happens to most people most of the time, but it does happen, and it happens more often to people worth targeting.
Where SMS still makes sense
- Accounts you barely care about: shopping sites, forums, loyalty programs.
- Older relatives who will genuinely not install an app, but will read a text.
- Work or legacy systems that offer nothing better.
- A temporary second factor while you migrate your important accounts to something stronger.
Authenticator Apps: The Best Everyday Balance
Authenticator apps generate codes on your device instead of sending them across a phone network. The standard behind them is time-based one-time passwords: your phone and the server share a secret, both run the same clock, and both produce the same six digits every thirty seconds. No message travels anywhere. No carrier employee can be talked into redirecting it.
Setup is usually a QR code. Scan it with the app, and the account appears as a rotating code. One detail worth knowing: behind every QR code is a text secret. Save it in your password manager. If you lose the phone, that secret is how you restore the account without begging support.
Good options include Google Authenticator, Microsoft Authenticator, Authy, Aegis, and the built-in generators in password managers like Bitwarden and 1Password. Some sync your secrets to a cloud account so a lost phone is not a disaster; others keep everything local, which is safer but demands you keep backups. Decide which trade you want before you have twenty accounts loaded in.
Push-based apps, where you tap "approve" on your phone instead of typing digits, are convenient but have their own trap. Attackers can spam you with login prompts until you tap one by mistake, or call pretending to be support and ask you to approve a request. The rule is simple: if you did not just try to sign in, deny it. Modern apps often show a number you must match, which helps.
Hardware Keys: The Strongest Option Where It Counts
A hardware security key is a small device you plug into a USB port or tap against your phone. It uses the FIDO2 and WebAuthn standards, which means the key checks the actual web address it is talking to before signing anything. A lookalike phishing domain gets nothing. There is no code for anyone to trick out of you over the phone.
Modern phones and laptops offer the same cryptographic idea built in, usually called passkeys. They are excellent, and they are gradually replacing both passwords and codes on major services. The catch is syncing: if your passkeys live in one company's ecosystem and you switch devices or platforms, you need a plan.
Buy two keys if you go this route, register both, and keep the spare somewhere you will find it. Keys are cheap enough for the peace of mind, but they still cost money, so most people reserve them for email, banking, and any account with administrative power over other people.
Matching the Method to the Account
- Email: the strongest option available, ideally a hardware key or passkey. Your inbox resets the passwords for everything else, so it deserves the best lock.
- Banking and payment apps: an authenticator app at minimum, a key if the bank supports one.
- Social media: an authenticator app. Account takeovers here spread scams to people who trust you.
- Work admin panels and cloud consoles: whatever your IT team requires, plus a hardware key if policy allows it.
- Low-stakes shopping and newsletters: SMS is fine. Do not spend an evening on it.
Setting It Up Without Locking Yourself Out
The single most common 2FA disaster is enabling it and then losing the only device that can approve a login. A few habits prevent it:
- Turn on the strongest method first, then add a weaker one as a fallback where the service allows it.
- Save recovery codes the moment they appear. Store them in your password manager and print a copy for a drawer or safe.
- Register a second device or key before you need it, not after.
- Test the setup in a private browser window so you are not fooled by an already-logged-in session.
- Review old trusted devices and sessions once a year and remove what you do not recognise.
One warning: some services let you choose a weaker method during login even when a stronger one is enabled. If a text message is offered as an alternative to your app code, an attacker who can intercept texts can simply pick that door. Where you can, disable SMS fallback on your most important accounts.
Start With Your Email, Today
You do not need to overhaul every login this week. Open your email account, enable app-based two-factor authentication, save the secret and the recovery codes, and register a second device. That single change protects the reset path for nearly everything else you own.
Then work outward: banking next, social media after that, and the rest whenever you get around to it. Choose the strongest method each service supports, accept that a physical key is worth it for a handful of accounts, and treat an unexpected login prompt as a reason to change your password rather than tap approve.
Photo: Nataliya Vaitkevich / Pexels
