Table of Contents
Two-factor authentication (2FA) is a security feature that asks for two different kinds of proof before letting you into an account: usually your password plus a second check, such as a code from an app, a tap on your phone, a fingerprint, or a security key. Even if someone steals your password, they still cannot get in without that second factor.
Every day, we use passwords to protect email, banking apps, social media, shopping sites, and cloud storage. But passwords alone are no longer enough. They can be guessed, stolen in data breaches, reused across sites, or handed over to a convincing fake website.
The problem is common. In a 2026 global survey by the FIDO Alliance, one in three people said they had experienced an account compromise or received a data breach notice in the past year.
At Victra, the largest Verizon Authorized Retailer with nearly 1,500 locations across the United States, customers often ask how to better protect the personal information on their phones and online accounts. Turning on two-factor authentication is one of the simplest and most effective steps you can take.
In this guide, you will learn what 2FA is, how it works, which methods are strongest, what U.S. cybersecurity experts recommend, how to protect your phone number from SIM swaps, and how to avoid the scams that target verification codes.
Key Takeaways
- 2FA adds a second lock to your accounts, so a stolen password alone is not enough to get in.
- Not all 2FA is equal. Security keys and passkeys are the strongest, authenticator apps are a solid middle ground, and text message codes are the weakest, but still far better than nothing.
- Never share a verification code. Anyone who asks you for one is a scammer.
- Passkeys are going mainstream, with an estimated 5 billion now in use worldwide.
- Verizon customers can turn on SIM Protection and Number Lock for free to help stop SIM swap and port-out fraud.
- Start with your email account, because most password resets go there.
What Is Two-Factor Authentication?
Two-factor authentication is a sign-in method that requires two different types of proof that you are who you say you are. The Federal Trade Commission compares it to using two locks on your door: a burglar who picks one lock still cannot get in.
What Does “Two Factors” Mean?
A factor is a category of proof. Most sign-in methods fall into one of three categories:
Knowledge
Information only you should know, such as a password or PIN.
Possession
A physical item you own, such as your smartphone, a security key, or an authenticator app on your phone.
Inherence
A physical trait, such as your fingerprint or face.
A password alone uses only one factor. Two-factor authentication combines two different categories, such as:
- Your password plus a code from an authenticator app on your phone
- Your password plus a fingerprint or face scan
- Your password plus a physical security key
An attacker would need both factors, not just your password, to access your account.
2FA vs. 2-Step Verification vs. MFA
| Term | What it means |
|---|---|
| Two-factor authentication (2FA) | Uses exactly two different factors. |
| Two-step verification | The name some companies, including Google, use for adding a second sign-in step. It works the same way for most people. |
| Multi-factor authentication (MFA) | Uses two or more factors. Every 2FA setup is a type of MFA. |
For everyday users, the terms are often used interchangeably.
Why Passwords Alone Are No Longer Enough
For years, passwords were the main way to protect online accounts. Unfortunately, they have serious weaknesses. People often:
- Reuse the same password across many sites
- Choose passwords that are easy to guess
- Store passwords in unsafe places
- Fall for phishing emails and fake login pages
- Have passwords exposed in data breaches
When one site is breached, criminals try the stolen email and password combinations on other sites. If you reuse passwords, one breach can unlock many accounts. Two-factor authentication greatly reduces that risk by requiring a second check before anyone gets in.
Victra tech tip: Use a unique password for every important account. A password manager can create and remember strong passwords for you, so you only need to remember one.
How Two-Factor Authentication Works
- Enter your usernameType your username or email address.
- Enter your passwordThis is your first factor: something you know.
- Get asked for moreThe service requests a second form of verification.
- Confirm it is youApprove a prompt, enter a code, touch a key, or use your fingerprint or face.
- Access grantedYou are signed in. An attacker without your second factor is stopped.
- Trusted devicesMany services let you skip the second step on your own phone or laptop.
Types of 2FA, Ranked From Strongest to Weakest
Any 2FA is better than none, but some methods offer much stronger protection than others.
- 1Security keyA physical key you plug in or tapStrongest
- 2PasskeyUnlocked with your face, fingerprint, or PINStrongest
- 3Push with number matchingApprove on your phone by typing a matching numberStrong
- 4Authenticator appSix-digit code that changes every 30 secondsGood
- 5Text message or email codeOne-time code sent to your phone or inboxBasic, but better than none
| Method | Blocks fake login pages? | Safe from SIM swaps? | Works without cell service? | Ease of use |
|---|---|---|---|---|
| Security key | Yes | Yes | Yes | Easy once set up |
| Passkey | Yes | Yes | Yes | Very easy |
| Push with number matching | Partly | Yes | Needs data or Wi-Fi | Very easy |
| Authenticator app code | No | Yes | Yes | Easy |
| Text (SMS) or email code | No | No (SMS) | No | Very easy |
1. Security Keys
A security key is a small physical device that connects to your phone or computer through USB, NFC, or Bluetooth. When you sign in, you plug it in or tap it to your phone.
Security keys are the strongest widely available form of 2FA because they only work with the genuine website they were registered to. A fake login page cannot trick the key into approving it. The trade-off is that you need to buy a key, and it is wise to register a backup key in case you lose one.
Security keys use the same tap technology as contactless payments. Learn more about how NFC works and how Bluetooth works.
2. Passkeys
A passkey is a digital key stored on your phone, computer, or password manager. You unlock it with your face, fingerprint, or screen lock PIN, and you never type a password at all. Like security keys, passkeys only work on the real website they were created for, which makes them resistant to phishing. Passkeys get their own section below.
3. Push Notifications
Some services send an approval request to an app on your trusted phone. Instead of typing a code, you tap Approve or Deny.
Push notifications are convenient, but criminals who already have your password sometimes send prompt after prompt, hoping you will tap Approve just to make them stop. This is called MFA fatigue or push bombing. The safer version, called number matching, asks you to type a number shown on your login screen into the app, which makes accidental approvals much less likely.
Important: If you get an approval request you did not trigger, tap Deny and change your password right away. Someone likely has it.
4. Authenticator Apps
Authenticator apps, such as Google Authenticator, Microsoft Authenticator, and Authy, create a new six-digit code every 30 seconds right on your phone.
- They work without cellular service.
- They are not affected by SIM swaps, because the codes never travel over the phone network.
- They are widely supported by major services.
Authenticator apps are a strong, practical choice for most accounts. Their main weakness is that a very convincing fake website can still trick you into typing a code, so always check the web address before entering one.
Victra tech tip: When you set up an authenticator app, save the backup or recovery codes the service gives you in a safe place. They can get you back into your account if you lose or replace your phone.
5. Text Message (SMS) and Email Codes
The most common form of 2FA sends a one-time code to your phone by text message or to your email.
Easy to use, supported almost everywhere, and no extra app required.
Requires cell service for text codes, text messages are not encrypted, vulnerable to SIM swaps, and can be phished by fake login pages.
Text codes are the weakest form of 2FA, but they still block the vast majority of automated attacks. If text messages are your only option for an account, keep using them, and upgrade to an app, passkey, or security key wherever you can.
Where Do Biometrics Fit In?
Fingerprint and face recognition count as “something you are.” On phones, they usually unlock the device or approve a passkey or app, rather than acting as a separate login factor for websites.
Biometric data generally stays stored on your device and is not sent to the websites you sign in to. Always keep a strong device passcode as well, because it is your backup if biometrics are unavailable.
What Are Passkeys?
Passkeys are one of the biggest changes in online security in years. Instead of a password, a passkey uses a pair of secure digital keys. One key stays private on your device, and the other is stored by the website. When you sign in, your phone proves it holds the private key after you unlock it with your face, fingerprint, or PIN.
Why Passkeys Are Safer
Nothing to steal from a breach
The website never stores your private key.
Phishing-resistant
A passkey only works on the real website it was created for.
Nothing to remember
There is no password to forget or reuse.
Two factors in one step
Your device (something you have) plus your fingerprint, face, or PIN (something you are or know).
Passkeys in 2026
Passkeys have gone mainstream. According to the FIDO Alliance’s State of Passkeys 2026 report, released in May 2026:
Major platforms are moving the same direction. In May 2025, Microsoft made brand-new Microsoft accounts passwordless by default.
How to Start Using Passkeys
Look for an option such as “Create a passkey” or “Sign in with a passkey” in the security settings of accounts you use often, especially your Google, Apple, and Microsoft accounts. Your phone will ask you to confirm with your face, fingerprint, or screen lock. Keeping your phone’s software up to date ensures you have the latest passkey support.
What the Experts Recommend
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) publishes guidance on protecting mobile communications. Its recommendations, written with high-risk users in mind, are useful for everyone:
- Use phishing-resistant sign-inCISA says hardware security keys are the most effective option, and passkeys are an acceptable alternative.
- Move away from text codesCISA’s guidance says not to use SMS as a second factor, because texts are not encrypted or phishing-resistant.
- Use an app for other accountsAuthenticator app codes are better than texts, although they can still be phished.
In December 2024, the FBI and CISA also advised Americans to move away from text message codes where possible.
CISA notes that some services still send text codes during account recovery, so you may not be able to avoid SMS completely. That is one more reason to protect your phone number, which we cover below.
The Federal Trade Commission’s advice is simpler: turn on two-factor authentication for your accounts, and never share your verification codes with anyone.
How Well Does 2FA Work?
Google studied how well different sign-in protections stopped account takeover attempts. Its 2019 research found:
Source data: Google Security Blog, 2019.
The takeaway: even the weakest form of 2FA stops nearly all automated attacks, and stronger methods also stop the more determined, targeted ones.
Passkeys also make signing in easier. Microsoft reported in 2025 that people signing in with passkeys succeeded 98% of the time, compared with 32% for passwords.
SIM Swapping and How to Protect Your Phone Number
How a SIM Swap Works
In a SIM swap, a criminal convinces a wireless carrier to move your phone number to a SIM card or device they control. Once they have your number, they can receive your text message codes and use them to break into your accounts.
SIM swaps are uncommon, but they can be costly. The FBI’s Internet Crime Complaint Center received 971 SIM swap complaints in 2025, with about $17.4 million in reported losses. Port-out fraud, where a criminal moves your number to a different carrier, works in a similar way.
Authenticator apps, passkeys, and security keys are not affected by SIM swaps because they do not rely on text messages. Learn more about how eSIM works.
Turn On Verizon SIM Protection and Number Lock
Verizon offers two free tools that help keep your phone number in your hands:
SIM Protection
Blocks SIM swaps, device upgrades, and other changes that require a new SIM on protected lines.
Number Lock
Blocks your number from being transferred to another carrier.
To turn them on in the My Verizon app:
- Open the appLaunch the My Verizon app.
- Go to your profileTap the Me tab, then Edit profile and settings.
- Find SecurityScroll to the Security section.
- Choose a protectionTap SIM Protection or Number Lock.
- Turn it onSwitch on protection for the numbers you want to protect.
- ConfirmSave your changes. Repeat for the other protection.
On the My Verizon website, go to Account > Account settings > Security settings. You need Account Owner or Manager access.
Good to know: When you are ready to upgrade your phone or swap SIMs, turn SIM Protection off first. After you turn it off, SIM changes stay blocked for 15 minutes as an extra safeguard. A line with Number Lock turned on cannot generate a Number Transfer PIN, and Number Lock must be off before you switch carriers. Learn more about the Verizon Number Transfer PIN.
From the Victra store floor: When customers come in to upgrade, one of the most common problems we see is getting locked out of accounts because a text-based or app-based 2FA was tied to the old phone. Before you trade in or reset an old phone, make sure your authenticator app, passkeys, and backup codes have moved to your new device.
2FA Scams to Watch For
Criminals know that 2FA blocks them, so many scams now focus on tricking you into handing over that second factor.
Never share a verification code
The FTC is clear: anyone who asks for your verification code is a scammer. That code is only for you to sign in. Real companies will not ask you to share it.
“Can You Read Me the Code?”
A caller, texter, or email pretends to be your bank, your carrier, a store, or even a government agency. They say there is a problem with your account and ask you to read back the code you just received. If this happens:
- Do not share the code.
- Hang up or stop replying.
- Contact the company using a phone number or website you already trust, not one the caller gave you.
- Report the scam at ReportFraud.ftc.gov.
A similar trick happens on online marketplaces, where a “buyer” asks you to read back a code to “prove you are real.” In reality, they are using your phone number to set up an account, such as a Google Voice number, in your name.
Unexpected Approval Prompts
If your phone keeps asking you to approve a sign-in you did not start, someone has your password. Deny every prompt and change your password immediately.
Fake Login Pages
Phishing sites copy real login pages to capture your password and your code at the same time. Always check the web address before signing in, and use passkeys or security keys where available, since they will not work on fake sites.
Losing Your Phone: Backup Codes and Recovery Options
Your phone is often your second factor, so plan ahead for losing it or upgrading:
Save backup codes
Store the one-time recovery codes from setup in a password manager or a printed copy at home.
Add a second method
For important accounts, add an authenticator app plus a passkey on another device or a security key.
Keep recovery info current
Make sure your recovery email and phone number are up to date.
Move 2FA before switching
Transfer authenticator accounts and confirm passkeys work on your new phone before wiping the old one.
Use synced passkeys
Passkeys saved to your Apple, Google, or password manager account can be restored on a new device.
If your phone is lost or stolen, act quickly. Learn how to find your lost phone, and when it is time for a new device, follow our guide on how to switch phones on Verizon.
How to Turn On 2FA for Your Most Important Accounts
Ideally, turn on 2FA for every account that offers it. If you are short on time, start with these, in this order:
- Email: Most password reset links go to your email, so protect it first.
- Banking and payment apps
- Your phone account, including Verizon SIM Protection and Number Lock
- Cloud storage and photo backup. See how to protect your cloud storage account.
- Password manager
- Social media
- Shopping sites that store your card
- Healthcare and government portals
Where to Find 2FA Settings
Google Account > Security > 2-Step Verification, and Passkeys
Settings > your name > Sign-In & Security > Two-Factor Authentication
Microsoft account > Security > Advanced security options
Menu names can change over time, so if you do not see these exact labels, look for “Security,” “Two-factor,” “2-step,” or “Passkeys” in the account settings.
Best Practices for Better Account Security
Two-factor authentication works best alongside other good habits:
- Use a unique password for every important account.
- Turn on 2FA wherever it is available, and choose the strongest method offered.
- Never share verification codes with anyone.
- Keep your recovery email and phone number current.
- Store backup codes in a secure place.
- Keep your phone’s software and apps updated.
- Avoid clicking links in unexpected texts and emails.
- Check website addresses before signing in.
- Consider using a password manager.
2FA Myths vs. Facts
MythA strong password is all I need
Fact: Strong passwords help, but passwords leak in data breaches. 2FA adds a second lock.
MythText message 2FA is useless
Fact: Text codes are the weakest option, but they still block most automated attacks. Upgrade when you can.
Myth2FA is only for businesses
Fact: Anyone with email, banking, shopping, or social media accounts benefits from 2FA.
Myth2FA makes me impossible to hack
Fact: 2FA greatly improves security, but scams can still trick people into sharing codes or approving prompts.
MythIf my bank calls, it is okay to share my code
Fact: Never share a code. Anyone who asks for it is a scammer.
Myth2FA is complicated
Fact: Most people spend only a few extra seconds signing in, and passkeys can make sign-in even faster than passwords.
MythCriminals only target famous people
Fact: Automated attacks target everyday people because their accounts hold valuable personal and financial information.
Quick 2FA Checklist
- 2FA is turned on for my email
- 2FA is turned on for my banking and payment apps
- My cloud storage account is protected
- Verizon SIM Protection and Number Lock are on
- I have saved my backup codes
- I use unique passwords or passkeys
- My recovery email and phone number are current
Frequently Asked Questions
What is two-factor authentication?
Two-factor authentication is a security feature that requires two different types of proof before you can sign in, such as your password plus a code from your phone, a fingerprint, or a security key. It keeps your account safe even if someone learns your password.
Why is two-factor authentication important?
Passwords are often stolen in data breaches or phishing scams. With 2FA turned on, a criminal who has your password still cannot get into your account without your second factor, which stops the vast majority of account takeover attempts.
What is the safest type of 2FA?
Security keys and passkeys are the safest, because they only work on the genuine website and cannot be tricked by fake login pages. Authenticator apps are next, followed by push notifications. Text message and email codes are the weakest, but still better than no 2FA.
Is SMS two-factor authentication still safe to use?
Text message codes are much safer than a password alone, but they are the weakest form of 2FA. They can be intercepted, phished, or stolen through a SIM swap. CISA recommends moving to an authenticator app, passkey, or security key where possible.
Is an authenticator app safer than text messages?
Yes. Authenticator apps create codes directly on your phone, so they work without cell service and are not affected by SIM swaps. They can still be phished by a convincing fake website, which is why passkeys and security keys are even stronger.
What is the difference between 2FA and MFA?
Two-factor authentication uses exactly two types of proof. Multi-factor authentication uses two or more. Every 2FA setup is a form of MFA, and for everyday users the two terms are usually used interchangeably.
What is two-step verification?
Two-step verification is the name some companies, such as Google, use for adding a second step to sign-in. For most people, it works the same way as two-factor authentication: after your password, you confirm your identity with a code, prompt, passkey, or security key.
What are passkeys?
Passkeys replace passwords with secure digital keys stored on your device. You unlock them with your face, fingerprint, or PIN. They are resistant to phishing and data breaches, and an estimated 5 billion are now in use worldwide.
Is a passkey the same as two-factor authentication?
Not exactly, but it offers similar protection in one step. A passkey combines something you have, your device, with something you are or know, your fingerprint, face, or PIN. Many services treat passkey sign-in as meeting their 2FA requirement.
What happens if I lose my phone with 2FA turned on?
You can usually get back in using backup codes, a second sign-in method, a security key, or your account’s recovery process. That is why it is important to save backup codes and add more than one method before you need them.
Can 2FA be hacked or bypassed?
It is much harder, but not impossible. Criminals may trick you into sharing a code, send repeated approval prompts, use fake login pages, or attempt a SIM swap. Never share codes, deny unexpected prompts, and use passkeys or security keys for the strongest protection.
Why would someone ask me for my verification code?
Because they are trying to break into your account. A verification code proves to a website that you are you, so a scammer who gets it can sign in as you. The FTC says anyone who asks for your code is a scammer.
What is a SIM swap, and how do I prevent it on Verizon?
A SIM swap is when a criminal moves your phone number to a device they control so they can receive your text codes. Verizon customers can turn on free SIM Protection and Number Lock in the My Verizon app under Security settings.
What are backup codes?
Backup codes are one-time codes a service gives you when you set up 2FA. Each code can be used once to sign in if you lose access to your phone or other second factor. Store them somewhere safe, such as a password manager.
I’m getting 2FA prompts I didn’t request. What should I do?
Deny them. Unexpected prompts mean someone has your password and is trying to sign in. Change your password right away, make sure it is not used anywhere else, and review your account’s recent activity and signed-in devices.
Final Thoughts
Passwords are still part of online security, but they are no longer enough on their own. Two-factor authentication adds a second lock that keeps your accounts safe even when a password leaks.
You do not need to do everything at once. Turn on 2FA for your email today, use the strongest method each account offers, lock down your phone number with Verizon SIM Protection and Number Lock, and never share a verification code with anyone.
Secure Your Phone With Victra
Need help securing your phone, moving your 2FA to a new device, or setting up Verizon account protections? Our Verizon experts are ready to help.
Find a Store Shop Phones
is a skilled Web Developer and Designer. He builds and designs websites that focus on best UI/UX practices. Justin is also a Verizon Product Expert at Victra, helping customers with Verizon products and services. His mix of design, coding, product, and general knowledge makes him a valuable and knowledgeable team member.
