What is 2FA (two-factor authentication)?
2FA requires two different kinds of proof to log in — something you know plus something you have. SMS codes are its most common (and weakest) second factor; passkeys its strongest.
Definition
Two-factor authentication (2FA) is login that demands proof from two independent categories: something you know (password, PIN), something you have (phone, hardware key), or something you are (fingerprint, face). A password plus an SMS code is 2FA; a password plus a security question is not — both are things you know. The point is that an attacker must compromise two unrelated channels, which turns most opportunistic password-stuffing attacks into failures.
The second factors in the wild, ordered roughly by strength: SMS or voice OTPs (universal but vulnerable to SIM swap and real-time phishing), authenticator-app TOTP codes (offline, immune to SIM swap, still phishable), push confirmations, and FIDO2/passkey cryptographic factors (phishing-resistant, since the credential is bound to the real domain). SMS remains the default second factor globally because it needs no app and no setup — which is why verification SMS is a pillar of A2P traffic and why attacks on it (SIM swap, OTP-relay phishing kits) are a professional criminal industry.
Why it matters
For a product team, 2FA choices set both your account-takeover rate and a real line item of SMS cost. The pragmatic stack: SMS for reach, TOTP offered to anyone who will take it, passkeys for high-value accounts — and fraud monitoring on the SMS layer you keep.
See it in action
Check what services a number is registered on →