Two-factor authentication (2FA) asks for a second proof of identity in addition to your password, such as a code from an app or a security key. Phishing-resistant methods like passkeys and hardware keys are strongest. App codes are better than texts, and any second factor beats none.
What is 2FA, exactly?
CISA lists several names for the same idea: multifactor authentication, two-step authentication, 2-step verification, two factor authentication and 2FA. You prove identity with a combination of something you know (a password or PIN), something you have (an authenticator app or a phone) and something you are (a fingerprint or face scan). CISA explains that even if an attacker compromises one factor such as a password, they cannot meet the second requirement, and that users who enable MFA are significantly less likely to be hacked.
CISA recommends starting with email, financial services, social media, online stores and gaming or streaming accounts. Email comes first because it is the route used to reset every other password.
Are all second factors equal?
No. The common types, from weakest to strongest in resisting phishing:
Text or voice messages. Easy to set up, but codes can be stolen by tricking a person into reading them out, or by attacking the phone number. NIST's digital identity guidelines add extra requirements for authentication over the public telephone network.
App-generated codes. A code that changes every thirty seconds or so, from an authenticator app. Better than texts, since there is no number to hijack. A fake login page can still collect the code and use it at once.
Push approvals. Convenient, but attackers can flood a user with prompts hoping for one tap. Number matching helps.
Passkeys and security keys. These use public-key cryptography tied to the real website, so a look-alike page gets nothing usable. NIST SP 800-63B-4 says applications assessed at authentication assurance level 2 must offer a phishing-resistant option, and level 3 requires a phishing-resistant authenticator with a non-exportable key.
NIST also says email must not be used as an out-of-band authentication channel, because it can be reached with only a password, intercepted in transit or rerouted.
What does a real failure look like?
A constructed example: a finance clerk gets an email that looks like a payroll portal. The page asks for a username, password and the six-digit code from the clerk's authenticator app. The clerk types all three. The attacker enters them on the real site within seconds and gets in. The company had 2FA, and it still failed.
With a security key or passkey, the browser would not have offered a credential to the wrong website. That is the difference between a second factor and a phishing-resistant one.
How do you roll it out?
Start with administrators, finance and anyone who can change payments or access. Offer passkeys or keys as the default and app codes as the fallback. Keep SMS only where nothing better works, and plan to retire it.
Recovery is the weak point. A strong factor with a weak reset process, such as a helpdesk that resets by email request, undoes your work. Define a recovery path that checks identity properly, and issue two keys per person so a lost one is not an emergency.
How to check or apply this
- Turn on 2FA for email accounts first, then banking and admin consoles.
- For staff accounts, require a phishing-resistant method for administrators and finance roles.
- Replace SMS codes with app codes or passkeys wherever the service allows.
- Issue each privileged person two security keys and store the spare safely.
- Review account recovery: who can reset a factor and how they verify identity.
- Turn on push number matching or limit prompts to stop approval fatigue.
- Track adoption by role, and report the gap to leadership each quarter.
Quick check
Is SMS two-factor authentication still worth using?
Yes, if nothing better is offered. It stops many password-only attacks. Move to app codes, passkeys or security keys when you can.
What does phishing-resistant mean?
The login proof is tied to the real website, so a fake page cannot capture something it can reuse. Passkeys and hardware security keys work this way.
Sources
Last reviewed: 18 October 2026.
