Two-factor authentication

Two-factor authentication asks for a second proof, such as a code or approval, besides your password, so a stolen password alone is not enough.

Two-factor authentication: Two-factor authentication, often called 2FA, adds a second step to signing in. You give something you know, such as a password, and something you have, such as a code from an app or an approval on your phone. A thief with only your password gets stopped.

Indian users already know 2FA through bank OTPs sent by SMS. It also exists in email, WhatsApp, Instagram and Google accounts. Stronger options are an authenticator app, which makes codes on the phone itself, or a security key. SMS codes are better than nothing but can be stolen by SIM swap or by tricking you. Keep backup codes in a safe place so that losing the phone does not lock you out of your accounts.

2FA fails only when you hand over the second code yourself. Scammers call and say they must read the OTP to cancel a payment or give a refund. Never share a code with anyone. Turn on 2FA for email first, because email can reset all your other accounts. Some apps now send an approval prompt; read what it says and refuse any you did not start.

Tips

• Switch on two-step verification for your email, WhatsApp and bank apps today.
• Prefer an authenticator app over SMS codes where an account offers both.
• Never read out or forward a code, even to someone claiming to be from the company.

Related terms