What is two-factor authentication?

Security experts group login proofs into three kinds: something you know (a password or PIN), something you have (a phone, security key or card) and something you are (a fingerprint or face). 2FA combines two of these, so a stolen password alone is not enough to break in. Common methods include text-message codes, authenticator apps that generate six-digit codes every 30 seconds, and physical security keys. Microsoft has reported that multi-factor authentication can block over 99 percent of automated account attacks. Text-message codes are the weakest option because of SIM-swap fraud.