Two-Factor Authentication (2FA)
Two-factor authentication (2FA) is sign-in that requires two distinct types of authentication factor, typically a password (something you know) plus a phone, code generator or security key (something you have), which makes it the most common form of multi-factor authentication. NIST SP 800-63-4 defines MFA as "an authentication system that requires more than one distinct type of authentication factor" and notes that a password plus a PIN is not two factors, because both are something you know.
The label says nothing about which second factor is in use, and that is where 2FA succeeds or fails. An SMS code, an authenticator-app code and a push approval all count as 2FA, and all can be handed to an attacker by a person who believes the request is genuine: in August 2026 the AnonyMousKIT kit used a rented AI voice agent to phone theft victims and ask for their 2FA code. A passkey or FIDO2 security key is also a second factor but cannot be read aloud or typed into a fake page, which is why policies should name the method class (phishing-resistant MFA) rather than just require "2FA".
See also: MFA, one-time password, phishing-resistant MFA, AAL, MFA implementation best practices, MFA device
Related on Start with Identity
- GlossaryPhishable MFA
Phishable MFA is any multi-factor method whose output a user can be tricked into handing to an attacker's site, which then replays it to the real one: SMS and v
- GlossaryAuthentication Policy
An authentication policy is an identity provider rule that decides which authentication methods a user must satisfy to reach a given application, based on condi
- GlossaryMFA Fatigue
MFA fatigue, also called push bombing, is an attack in which someone who already has a user's password triggers push approval prompts over and over until the us
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- Blog54% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let ad
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin