Two-factor authentication: choosing the right method

Credential stuffing works because billions of leaked username and password pairs circulate freely and many people reuse them. A second factor breaks that automation: the stolen password alone stops being enough.

It also buys time. Even a weaker second factor typically forces an attacker to target you individually rather than run an automated list, and individual targeting is far rarer.

Text messages are the most common second factor because they need no setup. They are also the weakest: SIM-swap fraud, number porting, message interception and simple social engineering all defeat them, and every code can be read out to a convincing caller.

Use SMS only where nothing else is offered, and remove your phone number as a recovery route on important accounts once a stronger method works.

Time-based codes generated on your device are a large step up, because no network message can be intercepted. They remain vulnerable to real-time phishing, where a fake page asks for the code and uses it immediately, so treat any request for a code that you did not initiate as an attack.

Choose an app with encrypted backup or store the setup keys in your password manager. Losing an authenticator with no backup is the most common way people lock themselves out.

Push notifications are convenient but created a new problem: approval fatigue, where an attacker sends repeated prompts until someone taps accept. Number matching, which shows a code on screen that you must type into the app, largely fixes this.

Never approve a prompt you did not trigger, and if prompts keep arriving, change the password immediately because it is already compromised.

Security keys and passkeys use domain-bound cryptography, so they do not work on a lookalike site. For email, financial and administrative accounts, this is the strongest practical protection available to consumers.

Register two keys where possible and keep the backup in a different physical location. For most households, passkeys stored in a password manager offer nearly the same protection with far less friction.

Before enabling anything, download the recovery codes and store them offline or in an encrypted vault. Register a second method so a single lost device is not fatal, and verify that your recovery email address is one you can still access.

Do the same for your password manager itself. If that account has a weak second factor, everything it protects inherits the weakness.

Protect the email address used to reset other passwords first, because anyone controlling it can reset most of your accounts. Then your password manager, then banking and payment services, then cloud storage, then social media.

Twenty minutes spent on those five categories removes the overwhelming majority of realistic account-takeover risk.

Every service that offers a second factor also offers a recovery route, and that route defines your real security level. A hardware key protecting an account that can be reset with a text message is only as strong as the text message.

Download recovery codes when you enable two-factor authentication, store them offline or in an encrypted vault, and re-check them yearly. If a service shows you the codes only once, treat that screen as the most important one in the setup process.

Shared accounts complicate matters, because a code tied to one person's phone blocks everyone else when that person is unavailable. A password manager with shared vaults and built-in code generation solves this cleanly, and keeps an audit trail of who has access.

In small businesses, enforce a second factor on email, finance and administrative systems first, and make offboarding a checklist item so departing staff lose access to the vault and to any registered devices.

Work through the official recovery process rather than searching for support numbers, which are a common target for fraud. Have your recovery codes, a previously trusted device, or a secondary registered method ready, and expect identity verification to take time.

Never allow anyone who contacts you to help with recovery. Fake support is one of the most reliable ways attackers defeat otherwise well-protected accounts.