Two-factor authentication (2FA)
Also called: 2FA · two-step verification · MFA · multi-factor authentication
Definition
Two-factor authentication (2FA) is a login and approval method that asks for a second proof, such as a code from an authenticator app or a security key, in addition to your password.
How two-factor authentication works
A password is something you know. 2FA adds something you have, such as a phone running an authenticator app, a hardware security key, or a phone number receiving SMS codes. An attacker who steals your password still cannot log in or withdraw without the second factor.
Not all second factors are equally strong. Authenticator apps (time-based one-time passwords) and hardware security keys or passkeys are generally stronger than SMS, which can be intercepted through SIM swapping. Many exchanges let you combine several methods and require 2FA for logins, withdrawals and security changes.
Keep the backup or recovery key that an authenticator app shows during setup. Without it, a lost phone can lock you out for days while the exchange verifies your identity.
Example
Suppose an attacker buys your email and password from a leaked database and tries to withdraw 2,000 USDT from your exchange account. The exchange asks for a 6-digit code that changes every 30 seconds in your authenticator app. The attacker does not have your phone, so the login fails. If you had only SMS codes and the attacker had taken over your phone number, the same attempt could have succeeded.
Common mistakes
- Relying only on SMS codes when the exchange offers an authenticator app or security key.
- Typing a 2FA code into a page you reached from an email or ad rather than the official app.
- Not saving the authenticator backup key, then losing access when the phone is replaced.
Learn and practise
FAQ
Which type of 2FA is best for crypto?
Hardware security keys or passkeys and authenticator apps are generally safer than SMS. Using more than one method gives you a fallback.
Can 2FA be bypassed?
Phishing sites can capture a code in real time and use it immediately. 2FA greatly reduces risk, but you still need to check that you are on the real site.