Two-factor authentication works on a simple principle: something you know plus something you have. Steal the password and you still cannot get in without the second thing.
The principle is sound. The implementations vary enormously in how well they hold up, and the most widely deployed one is also the weakest.
SMS codes
How it works: a six-digit code arrives by text message.
Why it is popular: everyone has a phone number, no app to install, no setup friction. For services trying to get 2FA adoption above a few percent, that matters.
How it fails: SIM swapping. An attacker contacts your mobile provider, impersonates you with a few personal details, and has your number transferred to their SIM. Your phone loses service, their phone starts receiving your texts, and every SMS code now goes to them.
This is not theoretical or rare. It is the standard technique for high-value account takeovers, particularly cryptocurrency accounts, and it has been used successfully against people who were being careful. The weak link is your mobile provider's customer service desk, over which you have no control.
SMS codes are also delivered over a network with well-documented interception weaknesses, and they can be phished like any other code.
Verdict: markedly better than nothing. Use it where nothing else is offered. Move away from it for anything that matters, and if your provider offers a port-out PIN or account lock, enable it.
Authenticator apps
How it works: an app generates a six-digit code that changes every thirty seconds, computed from a shared secret and the current time. No network involved.
Why it is better: there is no phone number to hijack. The secret lives on your device. SIM swapping does not touch it.
How it fails: phishing still works. A convincing fake login page asks for your password and then your code, and relays both to the real site within the thirty-second window. The code is valid, the attacker is in.
Practical note: save the recovery codes when you set it up. Losing the device without them means an account recovery process that can take days, or fail entirely.
Verdict: the sensible default for most accounts. A significant step up from SMS at very little cost in convenience.
Push notifications
How it works: a prompt appears on your phone. You tap approve.
How it fails: MFA fatigue. An attacker with your password triggers login attempts repeatedly — at three in the morning, dozens of times. Eventually someone taps approve to make it stop, or taps it half-asleep by reflex. This technique has been used in several large corporate breaches.
Implementations that show a number on the login screen which you must select on your phone largely defeat this, because approving requires information the attacker cannot supply.
Verdict: convenient, and fine when number matching is used. Never approve a prompt you did not initiate — an unexpected prompt means someone already has your password, and that password needs changing immediately.
Hardware security keys
How it works: a physical device, usually USB or NFC, that you touch to authenticate. Uses the FIDO2 and WebAuthn standards.
Why it is different in kind: the key verifies the domain it is talking to as part of the protocol. A phishing site at a lookalike domain does not receive a valid response, because the cryptographic challenge is bound to the real domain. This is not a matter of the user being careful — the attack simply does not work.
Google issued keys to all staff in 2017 and reported no successful phishing of employee accounts afterwards. That is the strongest evidence available for any consumer security measure.
Downsides: keys cost money, must be carried, and not every service supports them. Buy two and register both, keeping the spare somewhere safe.
Verdict: the strongest option available. Worth it for the accounts that protect everything else — your email above all.
Passkeys
Passkeys apply the same cryptography as hardware keys, with the credential stored in your phone, laptop or password manager and unlocked by biometrics. They replace the password entirely rather than adding to it.
They inherit the phishing resistance, because the credential is bound to the domain. They are considerably easier to adopt, because there is nothing to buy. Support has grown quickly and most major services now offer them.
Verdict: where offered, this is the direction things are moving, and the right choice for most people.
Where to spend the effort
Not every account deserves the same treatment. Prioritise by what an account can be used to reach.
Your email is the top priority. It is the reset mechanism for everything else. Whoever controls it controls all of it. Hardware key or passkey here, without exception.
Then your password manager, for the same reason.
Then financial and cloud accounts, where the direct loss is largest.
Then everything else, where an authenticator app is proportionate.
None of this removes the need for strong, unique passwords underneath. Two-factor authentication is a second line, not a replacement for the first — you can check what you are working with using our Password Strength Checker, and generate replacements with the Password Generator.
Summary
- SMS — better than nothing, vulnerable to SIM swapping, move away from it
- Authenticator app — good default, still phishable
- Push — convenient, needs number matching, never approve an unexpected prompt
- Hardware key — phishing-resistant by design, best available
- Passkey — the same protection without the hardware, adopt where offered
