What Is Two-Factor Authentication (2FA)?

Authentication factors fall into three groups: something you know (a password), something you have (a phone or hardware key), and something you are (biometric data such as a fingerprint). 2FA combines two of these groups. The most common implementations are codes sent by SMS, time-based one-time passwords (TOTP) generated by apps such as Google Authenticator, and physical security keys.

On crypto exchanges, 2FA is required for critical actions such as logging in, withdrawing funds and creating API keys. Even if a password is obtained through a data breach or phishing attack, the attacker cannot access the account because they do not have the second factor. For example, when a user requests a withdrawal, the transaction is not approved until they enter the six-digit code shown in the authenticator app on their phone.

Not all 2FA methods offer the same level of protection. SMS codes are vulnerable to SIM swap attacks, in which an attacker tricks the carrier into moving the victim's phone number to their own SIM card; for this reason, app-based codes and hardware keys are generally considered more resilient. To avoid losing access to your account if you lose your device, it is important to store backup codes in a safe place.