Two-Factor Authentication

Two-factor authentication requires a second proof of identity beyond a password, so a stolen password alone does not open an account. The common forms differ sharply in strength. A code sent by SMS is the weakest, because a phone number can be moved to an attacker's SIM by social engineering the carrier, and the code then arrives on their device. An authenticator app generates codes on the device itself with no network step, which removes that attack but not phishing: a code typed into a convincing fake site works there just as it would on the real one. A hardware security key is bound to the site's domain, so it will not respond to a lookalike address at all. Venues also differ in what the second factor protects — some ask for it at login only, others again at withdrawal, and the two are not the same protection.