Two-factor authentication: which second factor should you use?

Two-factor authentication means a stolen password is not enough. That is a large improvement, and it is why the NCSC describes multi-factor authentication as one of the most effective protections available for a password-protected account.

But the available second factors differ considerably in what they actually resist, and the difference matters most against the attack you are most likely to meet.

The comparison

That final column is the one worth understanding, because it separates the options that depend on your vigilance from the ones that do not.

Why codes can be defeated

A modern phishing kit does not copy a login page. It proxies the real one.

You enter your password on the fake page. The kit submits it to the genuine site immediately. The genuine site sends you a genuine code. You type the code in. The kit uses it within its thirty-second window and captures the resulting session.

A hardware key or a passkey does not participate. It is bound to a domain, and the phishing site's domain is not that domain, so no response is produced at all. There is nothing for the proxy to relay.

Method by method

SMS — the weakest, still worth having

Vulnerable to SIM swapping: an attacker persuades your mobile provider to port your number to their device, usually armed with personal details gathered from breaches and social media. Once the number moves, every code follows.

It is also relayable by a phishing proxy like any other code.

Despite all that, SMS still defeats credential stuffing entirely, which is the highest-volume attack there is. If SMS is all a service offers, turn it on.

Authenticator app codes

A six-digit code generated on your device from a shared secret and the current time. No network involved, so nothing to intercept and nothing to SIM swap.

Still relayable in real time, but a clear improvement, and available almost everywhere. For most accounts this is the sensible default when passkeys are not offered.

Push approvals

A prompt appears on your phone; you tap approve. Convenient, and vulnerable to fatigue attacks — an attacker with your password triggers prompts repeatedly, at night, until someone taps approve to make it stop.

Number matching fixes most of this: the login screen shows a number you must select on your phone, so approving requires seeing the screen the attacker controls. Enable it where available.

Hardware security keys

A physical device you plug in or tap. Phishing-resistant for the reason described above, and effectively immune to remote attack — someone would need the physical key.

The cost is that you need one, ideally two so a loss is not a lockout. Worth it for email, financial accounts, and anything holding significant value.

Passkeys

The same cryptographic protection, without buying hardware, because the key lives on a device you already carry. A passkey replaces the password and the second factor, and it is where authentication is heading.

Full detail in what are passkeys.

Recovery codes

The step everyone skips, and the one that causes the most pain later.

When you enable two-factor authentication, the service gives you a set of one-time backup codes. Save them. Print them, or store them in your password manager under a separate entry, or both.

Without them, losing your phone means account recovery through support — which is slow, sometimes impossible, and occasionally the exact process an attacker would target.

What to do, in order

1. Turn on the best available option for email first. Email resets everything else.
2. Then banking and anything with stored payment details.
3. Save every set of recovery codes as you go.
4. Take passkeys wherever they appear.
5. Consider a hardware key for your two or three most valuable accounts.

The specific attack that defeats SMS is worth understanding before you rely on it: SIM swap scams covers how a phone number is moved to someone else's device, and the free carrier lock that blocks it.