All lessonsLesson 04 / 08 · 4 min
Accounts
What two-factor authentication does
The second lock that keeps a stolen password from being enough.
Two different things you have
Two-factor authentication (2FA) asks for your password — something you know — plus a second proof, such as a code from an authenticator app or a hardware key. A stolen password alone stops being useful.
Codes by SMS are the weakest option
Text messages can be intercepted or a SIM can be ported to another device. An authenticator app or a passkey is stronger; a hardware security key is stronger still. Use SMS only when nothing better exists.
Never read a code out
If someone asks for the code that just arrived on your phone, they are trying to pass your second factor. No real support agent, bank, or employer needs it. Also back up your recovery codes somewhere offline.
A real-sounding attack
"This is IT support. We're restoring your mailbox. I've triggered a verification code to your phone — read it back to me so I can confirm your identity."
- The code is genuine; the request for it is not.
- The urgency and authority are the hook.
- The only safe answer is to hang up and call IT on a number you look up yourself.
Fictional example · harmless · no live link
Check your understanding
3 questionsQuestion 1 of 3