Two-Factor Authentication

Two-factor authentication (2FA) is a way of restricting access to a system by asking for two different authentication factors. Using two passwords does not count, because both are the same factor: something you know. The two factors must be different types, such as something you know and something you have, or something you know and something you are.

2FA is the most common form of multi-factor authentication. Multi-factor authentication means using more than one factor, but 2FA uses exactly two of the three factor types. That extra step makes it harder for someone who has stolen or guessed your password to get in, because they still need the second factor.

A common method is a password plus a temporary one-time code. The code is sent to a device or account that only the real user controls, such as their own phone, so a thief with your password still cannot read it. When you explain 2FA, always say where the code is sent, for example 'a code is sent to the user's phone', rather than only saying that a code is used: a code that anyone could receive proves nothing.

Other second factors

Security questions can be used as a second check because the real account holder is the person expected to recall the answers. They are still a knowledge factor, so they only form part of two-factor authentication when the other factor is a different type, such as something you have.

Biometrics can be used as a second check by matching a scan against stored biometric data. After typing a password, you might scan a unique body feature that is compared with the copy saved for your account; a match lets you in.