Two-factor authentication (2FA) requires a user to prove their identity using two separate types of evidence before gaining access. Because each factor comes from a different category, an attacker who steals a password still cannot log in without also controlling the second factor — making 2FA one of the most effective security measures available.
What are the three authentication factors?
Authentication methods fall into three categories, often called "factors":
| Factor | Description | Examples |
|---|---|---|
| Something you know | A secret the user has memorised | Password, PIN, security question answer |
| Something you have | A physical object or device | Smartphone (for a one-time code), smart card, hardware key (e.g. YubiKey) |
| Something you are | A biological characteristic | Fingerprint, face scan, iris pattern (biometrics) |
A single-factor system uses only one category — typically a password (something you know). Two-factor authentication combines any two factors from different categories. Using two passwords is not 2FA, because both are "something you know".
Why is a password alone no longer sufficient?
Passwords fail for predictable reasons:
- Weak passwords — many users choose guessable passwords such as dates of birth or common words.
- Reuse — people use the same password across multiple sites. When one site is breached, credentials are tried on others (a technique called credential stuffing).
- Phishing — users are tricked into entering passwords on fake websites.
- Data breaches — databases of hashed passwords are leaked and cracked offline using brute-force or dictionary attacks.
A 2FA system mitigates all of these. Even if an attacker obtains the correct password through any of the above methods, they still cannot log in without the second factor, which the attacker typically does not control.
How does 2FA work step by step?
Scenario: logging in to a banking app
- User enters username and password (something they know). ✓
- The server verifies the password is correct.
- The server sends a six-digit one-time code to the user's registered mobile phone (something they have).
- The user enters the code within the allowed time window (usually 30 seconds).
- The server verifies the code matches. ✓
- Access is granted.
An attacker who steals the password at step 1 is blocked at step 3: they do not have access to the user's phone and cannot receive or generate the code.
What are the common types of 2FA?
| Method | How it works | Strengths | Weaknesses |
|---|---|---|---|
| SMS code | A one-time code sent by text message | Easy to use; no app needed | Vulnerable to SIM-swapping attacks |
| Authenticator app | App generates a time-based code (TOTP) | More secure than SMS; works offline | Must have the phone available |
| Push notification | App prompts "Approve this login?" | Fast and user-friendly | Vulnerable to "MFA fatigue" — repeated requests annoy users into approving |
| Hardware key | Plug-in device signs the authentication | Extremely secure; not phishable | Must carry the key; can be lost |
| Biometric | Fingerprint or face scan | Convenient; cannot be forgotten | Privacy concerns; spoofing risk |
For GCSE, you are expected to know that 2FA combines two different factor types and to describe at least one example method. The SMS and authenticator app methods are the most commonly examined.
What is biometric authentication and how does it relate to 2FA?
Biometric authentication uses a physical characteristic that is unique to the user — a fingerprint, face geometry, or iris pattern. These are "something you are" factors. Biometrics are commonly used as part of 2FA: for example, unlocking a phone with a fingerprint (biometric) and then using that phone to approve a login (something you have) combines two factors.
Biometrics have important limitations:
- They cannot be changed if compromised — you cannot reset your fingerprint the way you reset a password.
- False accept and false reject rates mean they are not perfect.
- Biometric data stored in databases represents a high-value target for attackers.
Frequently asked questions
Is two-factor authentication the same as two-step verification?
The terms are often used interchangeably, but there is a technical distinction. Two-step verification uses two steps in the login process but they may both draw from the same factor category — for example, a password and a security question, both of which are "something you know". Two-factor authentication specifically requires two different factor categories. In everyday usage, both terms typically refer to the combination of a password and a code sent to a phone.
What is a one-time password (OTP) and how is it different from a regular password?
A one-time password is valid for a single login session or for a short time window (typically 30 seconds with authenticator apps). After that window, the code expires and is useless. This means even if an attacker intercepts the code, they cannot reuse it. Regular passwords, by contrast, remain valid until changed. Authenticator apps generate OTPs using the TOTP (Time-based One-Time Password) algorithm, which combines a shared secret with the current timestamp.
Can 2FA be defeated?
Yes, in certain scenarios. Real-time phishing attacks can trick users into entering a valid 2FA code on a fake site, which the attacker immediately relays to the real site before the code expires. Push notification fatigue attacks send repeated approval requests until the user accidentally or impatiently approves one. Hardware security keys are resistant to phishing because the key cryptographically verifies the site's domain. For GCSE, you should know that 2FA significantly raises the difficulty of an attack but does not make an account completely unbreakable.
When should a system not use 2FA?
Low-stakes accounts with no sensitive data may not warrant the friction of 2FA, particularly for users with accessibility needs who find additional steps difficult. The trade-off is between security and usability. For any account with financial information, health data, or access to other accounts, the benefit of 2FA almost always outweighs the inconvenience. Many modern systems make 2FA adaptive — triggering it only when a login appears unusual (new device, unfamiliar location), reducing friction for normal use.
For Socratic explanations of 2FA and every GCSE cybersecurity topic, visit Professor Turing at aitutors.me.