Home

Two-factor authentication(2FA)

Ever notice when you enter your card number, expiry date, and CVV, and click Pay the payment doesn’t go through immediately? Why is this? Instead, you’re asked for an OTP or biometric confirmation. That pause isn’t accidental—it’s a checkpoint. It ensures that even if someone else has your card details, they cannot complete the transaction without proving it’s exactly you who’s accessing the details. 

Just like adding extra protection before making any payments, you can also protect your online accounts to avoid any misuse or access by unauthorized users. Using two-factor authentication (2FA) you can secure your accounts safely as the only authorized person to access them. Two-factor authentication brings that same safety checkpoint to your account access.

What is two-factor authentication?

In simple terms, 2FA can be referred to as an extra security measure requiring different forms of verification methods to access an account.  This means adding an extra layer beyond your default password to log into your accounts. Two-factor authentication can be enabled across organization for all users. So, even if someone has access to one of your factors/modes of verification, without having access to the second factor they won’t be able to access your account.

Why is two-factor authentication important?

Apart from just adding a strong password, 2FA introduces an additional layer of security that reduces the risk of unauthorized access. Even if an attacker manages to obtain your password through phishing, data breaches, or malware, they still won’t be able to access your account without the second verification factor.

2FA is important because it:

• Prevents account takeovers by requiring a second proof of identity.
• Protects sensitive data such as emails, files, and personal information.
• Reduces the impact of weak or reused passwords.
• Meets modern compliance requirements with security standards.
• Protects against password theft and reduces the risk of hacking.

What are the factors in two-factor authentication?

2FA works by combining different types of verification factors before granting access. Those factors fall into three categories:

1. Something you know
   • PIN
   • Password
   • Security question
2. Something you have
   • Phone
   • Security key
3. Something you are
   • Fingerprint
   • Face ID

Using two factors from different categories makes it much harder for attackers to gain unauthorized access.

How does two-factor authentication work?

Two-factor authentication works as a two-step verification process to confirm a user’s identity.  Here’s how it functions:

Step 1: Primary authentication

The user enters a username and password (something they know). If the password is correct, the system moves on to the second verification step.

Step 2: Secondary authentication

The system requests a second proof of identity, such as:

• A one-time password (OTP) sent to the user’s phone (something you have).
• A code generated by an authenticator app.
• A fingerprint or face scan (something you are).

Only after both steps are successfully verified will access be granted to your account.

Example of 2FA in real life

When logging into a banking app:

• You enter your password.
• You receive a 6-digit OTP to your registered mobile number from the bank.
• You enter the OTP.
• Access is granted.

Even if someone has access to your password, they cannot log in without the second factor.

What methods are used for two-factor authentication?

Two-factor authentication provides various methods to conveniently login without restricting them to only one type of process to login securely. Some common methods include:

• Authenticator appsthat generate a time-based one-time password (TOTP): Apps like Zoho OneAuth and Google Authenticator generate time-sensitive codes every few seconds to login.
• SMS/automated voice: A TOTP will be sent your mobile number associated with your account.
• Push notifications: A prompt notification will be sent to your mobile phone asking for approval or declining to provide access to your account.
• Biometric authentication: You'll access your account using FaceID or fingerprint, which are unique to each individual, removing any third-person access.

What is an authenticator app?

Think of an authenticator app as a software version of a physical key you can use to unlock access to your accounts. In simple terms, an authenticator app can be referred to as a "digital key/code generator" or a "security code generator".  An authenticator app is considered safer and more secure compared to other methods used for two-factor authentication. 

Authenticator apps function locally on your device, making it immune to any "SIM swapping" and other possible network-based issues. This means it’s much more secure to deal with. These time-based codes, usually between six to eight digits, typically change every 30 to 60 seconds.

How do authenticator apps work?

Once you’ve entered your username and account password in the login URL, you’ll be asked to enter a time-based code generated in your authenticator app. Once you’ve entered that code on the login page, the server checks the code in your authenticator app against the code you’ve entered, and access will be granted. 

What is a one-time password?

A one-time password (OTP) is a code sent to your registered mobile device to verify your identity, but you can only use it once. When you need to log in again, a new OTP will be generated to allow you to access your account. So, even if your account details are stolen, no one will be able to access your account without entering the OTP, ensuring that your account details aren’t compromised.

Unlike traditional static passwords, which can be stolen and reused, an OTP is generated dynamically. It keeps changing using cryptographic algorithms and expires within a short window, typically ranging from 30 seconds to a few minutes. This reduces the risk of unauthorized access, identity theft, and fraudulent transactions across all of your platforms, keeping your data safe.

Authenticator apps vs. an OTP-based login

What are backup or recovery codes?

Say you lose access to your phone, authenticator apps, and security key, how would you access your account? Backup codes or recovery codes are one-time use codes that will be displayed when you’re setting up 2FA for your account. 

You can either copy these codes or download them locally on your computer to access when needed. You can use these codes as "emergency keys" when you lose access to your authenticator app or your mobile device.

How are backup codes different from authenticator app codes?

FAQ

1. What happens if you lose access to your secondary factor?

   When you lose access to your secondary factor, you can still log into your account only if you’ve enabled other backup options to log in. If no backup option is enabled, you’ll need to go through the account recovery process to access to your account again. Some of the backup options are:

   • Backup codes: When you first set up 2FA, always remember to store your backup codes (one-time use codes) in a safe place in case your lose access to your secondary factor.
   • Logged in on an alternate device: Use another logged in device, such as your tablet or another laptop, to access your account.
   • Use multiple TFA modes: Don’t reply only on one method for 2FA verification. For example, if you have 2FA enabled on your phone, add another security layer as well.
   • Alternate mobile number: When you set up 2FA, add a different mobile number from the registered mobile number associated with your account to receive an OTP.

2. Is two-factor authentication mandatory?

   No, it isn’t mandatory, but it’s strongly recommended to have 2FA enabled for your account. It allows you to safeguard your account against any unauthorized access and helps you gain access in case your account is compromised.

3. Can two-factor authentication be turned off?

   Yes, it can be turned off, but having two-factor authentication always enabled for your account is recommended. If 2FA is disabled, it makes it easier for third parties to access your account details as well as makes it harder for you to gain access to your account again.

Two-factor authentication secures your account

2FA is an added security layer that requires different verification methods to access an account, such as a password plus an OTP, an authenticator app code, or a biometric scan. It works in two steps; first verifying something you know, then confirming something you have or are, making it much harder for attackers to gain access even if your password is compromised. 

Common methods include SMS OTPs, authenticator apps, push notifications, and biometrics, with authenticator apps being more secure because they generate time-based codes locally on your device. Backup or recovery codes act as emergency access if you lose your secondary factor. Overall, 2FA protects sensitive data, prevents account takeovers, and significantly reduces the risk of your accounts being hacked.