Two-Factor Authentication: Which Method to Use

A stolen password stops being enough on its own.

Passwords leak in predictable ways: phishing pages trick people into typing them, and scammers buy usernames and passwords stolen in data breaches, then try them on other sites where the same pair was reused. Two-factor authentication asks for a second credential from a different category — something you have, such as a code or a security key, or something you are, such as a fingerprint — on top of something you know. The FTC’s summary: even if someone knows your username and password, they cannot sign in without the second factor.

Their weak point is the phone number, not the code.

A six-digit code sent by text message is the most common method and needs only a phone. Its weakness is the delivery channel. In a SIM swap, a criminal takes over your phone number and receives your texts, codes included. NIST’s 2025 authentication guidelines, SP 800-63B-4, name codes delivered over the phone network as their only “restricted” authenticator — still allowed, but with known risks — and tell services to consider signs such as a SIM change or a ported number before sending one. A code sent by email is only as safe as the email account, so protect that account with its own strong password and second factor. The FTC’s verdict: if text or email is the only option an account offers, use it; it is better than nothing.

The code comes from your device, not the phone network.

Apps such as Google Authenticator, Microsoft Authenticator, and Duo generate a fresh code on your phone or tablet, so a SIM swap or a hacked inbox does not expose it. Some send a push notification instead, showing which account is being signed into, from what kind of device, where, and when, and you approve or deny with a tap. Read those details every time, and deny any request you did not start.

They check the website for you.

A security key is a small device that plugs into a USB port or connects by NFC when held near your phone. The FTC calls security keys the strongest method of two-factor authentication because they do not use credentials that hackers can steal. The technical reason: the key’s credential is bound to the real site’s domain, so a look-alike phishing page cannot capture anything it could reuse — the property NIST calls phishing resistance. Passkeys bring the same protection to phones and laptops; see how passkeys work.

Scammers ask for the code itself.

A common scam no longer needs your password from you. It needs the code, and it comes with a story: a bank “confirming” a transfer, a delivery company, a friend locked out of an account. The FTC’s rule is simple: no matter what the story is, do not share a verification code with someone you did not contact first. The phishing guide covers the other warning signs.

Start where a takeover hurts most.

Two-factor authentication is usually not on by default. Look in each account’s security settings for “two-factor authentication,” “two-step verification,” or “multi-factor authentication.” The FTC suggests starting with your bank, credit cards, email, social media, tax filing website, and payment apps, then adding shopping sites. Email belongs near the top because password resets for your other accounts arrive there. During setup, many services offer backup codes for the day you lose your phone or change your number — Google, for example, lets you sign in with a backup code when your usual second step is unavailable. Keep them somewhere other than the phone.