Two-factor authentication

Two-factor authentication is MFA with exactly two factors, and in practice almost always a memorised secret plus a possession factor. The terms "2FA" and "two-step verification" (the name Google used when it opened the feature to all accounts in 2011) are often used interchangeably, but they are not strictly equivalent: two steps are not two factors if both are the same category, and a code sent to an email inbox reachable with the same password adds a step without adding an independent factor. Standards avoid the loose terms. NIST SP 800-63B speaks of multi-factor authentication at AAL2, and the PSD2 strong customer authentication rules require two independent elements from different categories.

The common second factors differ sharply in strength. SMS and voice codes depend on the phone network and are exposed to SIM-swap fraud, number porting and SS7 interception; NIST classes them as restricted. TOTP apps (RFC 6238) remove the network dependency but still produce a code a human can be tricked into typing on a phishing page. Push approvals are convenient but invite prompt bombing unless number matching is enforced. A FIDO U2F or FIDO2 security key used as the second factor after a password is phishing-resistant, because the signed response is bound to the site's origin. A passkey with user verification (a PIN or biometric on the device) is itself two factors in one step, which is why passkey-based login is often described as replacing, rather than adding to, the password-plus-code pattern.

The weakest link is usually not the primary second factor but the fallback. Services that offer SMS as a backup to a security key, account recovery by email, or a help-desk reset based on knowledge questions reduce the effective strength to that of the weakest enabled path; attackers target those paths precisely because the main factor is strong. Recovery codes - a short list of single-use secrets issued at enrolment - are a better fallback if stored offline.

2FA also does not protect what happens after login. Session cookies and refresh tokens captured by adversary-in-the-middle proxies, malware stealing browser cookies, and legacy protocols that accept only a password all sidestep the second factor. Organisations therefore enforce 2FA through central policy (conditional access in the identity provider) rather than per-application opt-in, disable legacy authentication, and monitor for new device registrations, which are a typical persistence step after an account takeover. In Denmark, MitID (for citizens) and MitID Erhverv (for organisations) provide the national multi-factor login, based on a user ID and an authenticator such as the MitID app, a code display, a code reader or a MitID chip.