Two-Factor Authentication: The Small Step That Makes a Big Difference

Two-factor authentication (2FA) requires a second proof of identity, such as a code or a physical key, in addition to your password, so a stolen password alone isn’t enough to break into your account. Turn it on for your email, banking, and social media first, and use the strongest method each account offers: a passkey or hardware security key if possible, an authenticator app next, and text-message codes only as a last resort.

Passwords leak constantly, and people reuse them. 2FA is the safety net for that. If a criminal has your password but not your phone or your key, they’re stuck at the second door. Not all second doors are equally strong, though, and the weakest common one, the text message, has a documented history of being bypassed.

A Real Example: When the Text Message Was the Weak Link

In February 2022, the FBI’s Internet Crime Complaint Center warned that criminals were increasing “SIM swap” attacks. In 2021 alone, the FBI received 1,611 SIM swapping complaints with losses of more than $68 million. In a SIM swap, a criminal convinces your mobile carrier (through social engineering, a bribed insider, or phishing) to move your phone number to a SIM card they control. From then on, your calls and texts go to them. They request password resets on your bank, email, or cryptocurrency accounts, and the text-message verification code arrives on their phone instead of yours.

The victims in these cases often had 2FA turned on. The method they chose is what failed. The FCC responded in November 2023 with new rules requiring wireless carriers to authenticate customers before moving a number to a new SIM or carrier and to notify customers immediately of those requests. Those rules help, but the lasting lesson is simpler: a second factor tied to your phone number is only as secure as your carrier’s customer-service process.

What 2FA Actually Is

Authentication factors fall into three categories: something you know (a password), something you have (a phone, a key), and something you are (a fingerprint or face). 2FA combines two different categories. Typing your password and then a second password doesn’t count. Typing your password and then a code from your phone does.

The Main 2FA Methods, Ranked

CISA, FBI, and NSA joint guidance issued in December 2024 says this directly. It advises avoiding SMS-based MFA where possible, notes that SMS messages are not encrypted, and states that while authenticator codes are better than SMS, they are still vulnerable to phishing. It calls FIDO authentication the strongest form and the one effective against MFA bypass techniques. That guidance was aimed at highly targeted people, but the same ranking applies to everyone’s most important accounts.

Why 2FA Matters

• It neutralizes leaked passwords. Breaches happen at companies you have no control over. With 2FA, a leaked password isn’t enough on its own.
• It stops credential stuffing. Attackers try breached email-and-password pairs against other sites. A second factor blocks most of these attempts.
• It’s free. Every major email, banking, social media, and shopping platform offers it at no cost.
• It gives you an alert. An unexpected code or prompt is a sign someone has your password. Change it right away.

How to Turn On 2FA (In Order of Priority)

1. Your primary email account first. Email is the master key: password resets for nearly everything else go through it.
2. Banking, brokerage, and payment apps.
3. Your password manager. See our password manager comparison.
4. Social media and cloud storage. See how to secure your social media accounts and our cloud safety guide.
5. Everything else that offers it.

For each account:

1. Open Settings, then Security (sometimes labeled “Login & security” or “Password & authentication”).
2. Find “Two-factor authentication,” “2-step verification,” or “Multi-factor authentication.”
3. Choose the strongest option offered: passkey or security key, then authenticator app, then SMS.
4. Save your backup codes (see below) before you close the page.
5. Log out and back in to confirm it works.

Backup Codes and Recovery: Don’t Lock Yourself Out

The most common 2FA failure is the owner losing access, not a hacker. Prepare for a lost or replaced phone:

• Download and store the backup codes each service gives you, in your password manager or printed and kept somewhere safe at home.
• Register a second method where possible, such as two security keys, or an authenticator app plus a backup key.
• Check your authenticator app’s backup options. Some apps sync codes to an encrypted cloud backup, and some don’t. If yours doesn’t, you must move the codes to the new phone yourself before wiping the old one.
• Never store backup codes in your email inbox. If someone breaks into your email, they’d have your recovery keys too.

Protect the Weak Link: Your Phone Number

If you still rely on text codes for some accounts:

1. Ask your carrier to add a PIN or “port-out lock” to your account, so the number can’t be moved without it.
2. Don’t use your phone number as a public identifier on social media.
3. Switch those accounts to an authenticator app or passkey as soon as the service allows.
4. Never read a 2FA code to anyone who calls or texts you. Scammers impersonate banks and tech support to get you to read it out. No legitimate company will ask. See our guides to text scams and vishing.

What to Do If You Suspect Your 2FA Was Bypassed

Signs: your phone suddenly shows “No Service” or “SOS only” when it normally works; you get 2FA codes or password-reset messages you didn’t request; you’re logged out of accounts unexpectedly; your carrier sends a “SIM changed” notice you didn’t trigger.

1. Call your carrier right away from another phone, tell them you suspect a SIM swap, and ask them to restore your number and lock the account.
2. Reset your email password first, from a trusted device, then your banking and other critical accounts. Switch them to an authenticator app or security key at the same time.
3. Contact your bank and card issuers using the number on your card and ask about unauthorized activity.
4. Check account recovery settings (backup email, phone number, trusted devices) on your key accounts. Attackers often add their own.
5. Report it at ic3.gov (FBI) and ReportFraud.ftc.gov (FTC).
6. Watch your accounts and credit for several weeks afterward.

People Also Ask

Sources: FBI Internet Crime Complaint Center, public service announcement on SIM swap schemes (February 2022); Federal Communications Commission, rules on SIM-swap and port-out fraud (November 2023); CISA, FBI, NSA, Mobile Communications Best Practice Guidance (December 2024)