Two-Factor Authentication Explained: Why Every Account Needs It

The Microsoft Statistic You Should Know

In 2019, Microsoft analysed over 1.2 million compromised accounts over 30 days. Their finding: 99.9% of compromised accounts did not have multi-factor authentication enabled.

Think about that. A single 30-second setup step would have prevented almost all of them.

What Two-Factor Authentication Is

Authentication factors are categories of proof that you are who you claim to be:

• Something you know: your password
• Something you have: your phone, a hardware key
• Something you are: your fingerprint, face

Two-factor authentication (2FA) requires two of these. The most common implementation: your password (something you know) plus a one-time code from your phone (something you have).

Even if an attacker has your password — through a breach, phishing, or guessing — they cannot log in without the second factor. The temporary code expires in 30 seconds and cannot be reused.

Types of 2FA (Ranked by Security)

Hardware Security Keys (most secure): Physical devices (YubiKey, Google Titan) that you plug in or tap. Cannot be phished — the key only responds to the legitimate site. Used by high-security organisations and recommended for your most important accounts.

Authenticator Apps (highly secure): Apps like Authy, Google Authenticator, Microsoft Authenticator, or 1Password generate time-based one-time codes (TOTP). More secure than SMS, not dependent on your phone carrier.

SMS/Text Message (least secure but still valuable): A code is texted to your phone number. Vulnerable to SIM swapping attacks, where an attacker convinces your carrier to transfer your number to their SIM. Still vastly better than no 2FA.

Which Accounts Need 2FA First

Prioritise in this order:

1. Email — your email can reset everything else. This is the most important account to secure. 2. Banking and financial accounts 3. Password manager 4. Social media (compromised accounts are used for fraud targeting your contacts) 5. Work accounts 6. Everything else that offers it

Setting Up 2FA in 5 Minutes

1. Download Authy or enable 2FA in your password manager (1Password and Bitwarden both support TOTP) 2. Go to your email account's security settings 3. Find "Two-factor authentication" or "Two-step verification" 4. Select "Authenticator app" 5. Scan the QR code with your authenticator app 6. Enter the 6-digit code to confirm 7. Save your backup codes somewhere safe

That is it. Repeat for your other priority accounts.

Why the Ranking Is What It Is

The security ordering of 2FA methods is not arbitrary — it follows from one question: can the second factor be relayed to an attacker by a convincing fake login page?

The bottom row is categorically different rather than incrementally better. A security key or passkey checks the site's identity before it responds, so a fake page cannot obtain anything usable. Every method above it depends on you correctly identifying the site, which is exactly what phishing is designed to defeat.

NIST SP 800-63B is explicit about this distinction, and the article above quotes its definition directly.

Recovery Is the Part That Fails

More people lose access through their own 2FA than are ever attacked through it. Setting up recovery at enrolment time, not later, prevents nearly all of it:

• Save backup codes somewhere that survives losing your phone. Printed, or in

your password manager on a device that is not the phone itself.

• Enrol a second authenticator where the service allows it. Two keys, or an app

on a second device.

• Do not rely on a single physical key. Anyone using hardware keys seriously

registers two and keeps one elsewhere.

• Check whether your authenticator app backs up its secrets, and whether that

backup is encrypted. Some do, some do not, and the difference is discovered at the worst moment.

• Re-check recovery after changing phones. Migration silently drops entries more

often than it should.

Where to Enable It First

Not every account justifies the friction, and starting everywhere is why people stop. In order:

• Email, because it resets everything else.
• Your password manager, because it holds everything else.
• Banking and payment.
• Your mobile carrier account, which is what SIM-swap attacks target.
• Cloud storage and any account tied to work.
• Social accounts, especially any used to sign in elsewhere.

Then, as passkey support widens, replace codes with passkeys on those same accounts in the same order. The practical comparison of apps is in best 2FA apps, and how attackers get the first factor in the first place is in how hackers get your password.

The Backup Code Warning

Every service that offers 2FA also gives you backup codes — single-use codes for when you lose your phone. Print these or store them in your password manager. Losing your 2FA device without backup codes can lock you out of your own accounts.

Written by NorwegianSpark Editorial — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.