What is two-factor authentica­tion (2FA)?

2FA: definition and factors

With two-factor authentication, users prove their identity with two factors from different categories: knowledge (password, PIN), possession (smartphone, security key) or inherence (fingerprint, face). Two passwords would not count as 2FA because both belong to the same category. If more than two factors are required, it is called multi-factor authentication (MFA).

The reason for the method is simple: passwords are guessed, captured through phishing or reused after data leaks. Once a second factor is active, an attacker with only the password fails. That is why the method is among the most effective single measures for protecting user accounts.

The common methods compared

Not every second factor is equally strong. A code sent by SMS is better than nothing but can be intercepted through SIM swapping or phishing. Codes from authenticator apps (TOTP) are more robust. The strongest are methods based on the FIDO2 standard, meaning security keys and passkeys: they are bound to the real address of the website and cannot be captured on fake pages.

• SMS or email code: simple, but easiest to circumvent
• Authenticator app (TOTP): the code changes every 30 seconds, no mobile network needed
• Push approval: convenient, but vulnerable to “fatigue attacks” through repeated requests
• Hardware security key (FIDO2): very strong against phishing
• Passkeys: FIDO2 sign-in via device and biometrics, replaces the password

Real-world example: a hijacked mailbox in accounting

At a wholesaler with 40 employees, the bookkeeper enters her Microsoft 365 password on a deceptively real sign-in page. Without a second factor, attackers could take over her mailbox, send customers invoices with a changed bank account in the company’s name and quietly set up forwarding rules to read the replies.

With 2FA enabled, the attackers’ login fails at the second-factor prompt. The company gains time: the bookkeeper reports the incident, the password is reset, active sessions are terminated. What matters is that 2FA applies to all accounts—not just to management.

Rollout, limits and common mistakes

The first accounts to protect should be email accounts, admin and cloud access, accounting and online banking, domain and hosting administration, and social media accounts. Even 2FA is not unbeatable: in adversary-in-the-middle attacks, one-time codes can be read along. Phishing-resistant methods such as FIDO2 are therefore the goal.

Nano Concepts introduces 2FA and passkeys in Microsoft 365, cloud services and custom applications, trains teams in using them and plans recovery paths for the case of loss so that no employee stays locked out. If you wish, we also set up the devices, so the changeover takes hardly any time in daily work.

• No recovery codes saved and no backup device set up
• SMS as the only factor for sensitive accounts
• Exceptions for “important people” or service accounts
• Approving every push request without thinking
• No process for lost or broken smartphones