Two-Factor Authentication: Which Kind Actually Protects You

Turn on two-factor authentication. It’s good advice. It’s also incomplete. It treats every method as if it buys the same protection, and it doesn’t. A text-message code and a hardware key both count as 2FA, but one of them can be defeated by a scammer who has your phone number and a convincing story, and the other can’t.

I spent 20 years building the systems that verify who you are when you log in. The most useful thing I can tell you about 2FA is that the method matters more than the simple fact that you switched it on. Here’s how the common methods actually rank, why the ranking looks the way it does, and how to move an important account off text-message codes without locking yourself out. That last part is the step that stops most people, so I’ll walk through it slowly.

What 2FA Actually Does, and What It Doesn’t

Two-factor authentication adds a second lock. Your password is the first factor, something you know. The second factor is something you have, like a phone, an app, or a physical key, or something you are, like a fingerprint. The point is that a stolen password by itself stops being enough to get in.

That matters most against one specific attack: credential stuffing. That’s when someone takes a username and password leaked in one company’s breach and tries the same pair on your email, your bank, and everywhere else, betting that you reused it. Against that attack, almost any second factor works. The attacker has your password and nothing else, and the second factor blocks them cold.

The trouble is that not every attack is credential stuffing. The one that separates strong 2FA from weak 2FA is phishing, where a fake login page tricks you into entering your credentials so the attacker can grab them. The dividing line between methods comes down to a single property: phishing resistance. A phishing-resistant method ties your login to the real website, so a counterfeit copy of your bank’s login page can’t use what it captures. A method that isn’t phishing-resistant asks you, a human, to notice the fake and refuse to hand over the code. Attackers have gotten very good at beating that human step, which is why the FTC’s guidance on phishing treats it as a threat you shouldn’t expect to spot every time.

Hold on to that distinction and the ranking below writes itself.

The Methods, Ranked by How Much Protection They Buy

Text-Message Codes (SMS): Better Than Nothing, Weaker Than You Think

Here’s how it works. The service texts you a six-digit code, you type it in, you’re through. It’s everywhere because every phone can receive a text with no app required. Against a plain reused-password attack, it does the job.

Here’s the catch. Your phone number isn’t a secure vault. It’s a routable address your carrier controls, and it can be moved. In a SIM swap, a criminal calls your carrier, pretends to be you, and talks them into moving your number to a SIM card sitting in the criminal’s hand. Now your codes arrive on their phone. This happens often enough that the FCC adopted rules in 2023 requiring carriers to verify you before moving a number and to alert you when a change is requested. The second weakness is simpler. A phishing site can ask for your text code and relay it to the real site within seconds. The code has no way of knowing it’s being passed along.

Use SMS if it’s the only option a service offers. It beats a password alone. But for the accounts that matter, treat it as a temporary bridge, not the place you stop.

Authenticator Apps: The Sweet Spot for Most People

An authenticator app, such as Google Authenticator, Microsoft Authenticator, or Authy, generates a fresh six-digit code every 30 seconds right on your device. The technical name is TOTP, a time-based one-time password. You scan a QR code once during setup, and after that the app and the service both calculate the same code from a shared secret and the clock. No text message, no phone number in the loop.

That missing phone number is the whole upgrade. Because the code is generated on your device, a SIM swap doesn’t reach it. A criminal can hijack my number and still get nowhere, because the codes live on the phone in my pocket. For most people, on most accounts, an authenticator app is the right default. It’s free, it works even with no signal, and it closes the biggest hole in SMS.

It isn’t flawless. It’s still a code you type, so a convincing fake login page can trick you into relaying it. And there’s a quieter risk that catches people off guard, which is what happens when you lose the phone. A 2025 study from UC Berkeley found that most authenticator-app users had cloud backup switched on, often without knowing it, and that a real share of users had no backup plan at all. Both ends of that are a problem. If you don’t know where your codes are backed up, you don’t know who else can reach them. If they’re backed up nowhere, a lost phone can lock you out of everything at once. The fix is dull and effective. When a service offers backup or recovery codes, save them somewhere offline. More on that shortly.

Hardware Security Keys: The Strongest, for the Accounts Worth Protecting

A hardware security key is a small physical device, about the size of a house key, that you plug in or tap against your phone to log in. The common ones are YubiKeys and Google’s Titan keys. This is the category the security field calls phishing-resistant, and it earns the name.

Here’s why it’s different. When you register a key with a site, the key creates a unique cryptographic pair tied to that exact site’s web address. At login, the key proves it holds the secret without ever revealing it, and it only answers to the real address it was registered with. A fake login page at a lookalike domain gets nothing it can use, because the key won’t respond to the wrong address. You don’t have to spot the fake. The protection doesn’t lean on your judgment in the moment, which is exactly why it holds up when everything else fails. Both CISA and NIST, the federal agencies that set security guidance, put hardware keys at the top of their recommended methods.

The trade-offs are real. You have to buy one, they run roughly $30 to $70, the site has to support them, and if you lose your only key you can be locked out. The answer to that last one is straightforward. Buy two, register both, and keep the spare somewhere safe. For your most valuable accounts, your primary email, your bank, your password manager, that’s a reasonable thing to do.

Here’s the ranking at a glance.

So What Should You Actually Do?

Match the method to the account. You don’t need a hardware key on your grocery-store loyalty login. You do want your strongest factor on the accounts that can unlock everything else.

Start with email. Your inbox is the skeleton key, because password resets for almost every other account land there. If someone owns your email, they can walk into the rest. Put your best available factor on it first, a hardware key if your provider supports one, an authenticator app if not. Then do the same for your bank, your password manager, and any account tied to your money or your public identity, like your main social media accounts. For everything else, an authenticator app is a fine default, and SMS is an acceptable last resort where it’s the only choice.

One thing 2FA is not is a substitute for good passwords. It’s a second barrier, not the first. Unique passwords, ideally kept in a password manager, remain the foundation everything else sits on.

How to Move an Important Account Off SMS Without Locking Yourself Out

This is the step that scares people, and the fear is reasonable. The nightmare version is deleting your text-message codes and then finding you can’t get back in. So the entire trick is to prove the new method works before you remove the old one. Do it in this order and you won’t get stranded.

1. Start on a device you’re already logged in on. Work from a phone or computer where you’re currently signed into the account, on your normal connection. Don’t begin from a locked-out position.
2. Add the stronger factor first. Turn on an authenticator app, or register a hardware key, two keys if you’re going that route. Leave SMS in place for now. You want both active at the same time.
3. Save your recovery codes offline. Most services hand you a set of one-time backup codes when you add a factor. Generate them, write them down or print them, and store them somewhere that isn’t the phone you’re about to change. These are your safety net if the new factor ever fails.
4. Test the new factor before removing anything. Open a private browser window or grab a second device and log in fresh using only the new method. If it works cleanly without the text code, you’re ready. If it doesn’t, stop, and leave SMS alone.
5. Keep your carrier protections on. Set a PIN or passcode on your mobile-carrier account if you haven’t already. Even after you stop using text codes for this account, your phone number still matters elsewhere, and a carrier PIN makes a SIM swap harder.
6. Now remove SMS, then test once more. Delete the text-message factor from the account. Log out, log back in with the new method, and confirm the account no longer falls back to a text code.
7. Watch the account for a few days. Keep an eye on security alerts. If anything looks wrong, use your spare key or a recovery code to get in and reset.

The order is the whole point. Add, save, test, then remove. As long as you never remove SMS before a clean login without it, there’s no way to lock yourself out.

The Honest Bottom Line

Two-factor authentication is the highest-value security step you can take after using unique passwords, and it isn’t close. But “turn on 2FA” hides a ranking that matters. A hardware key on your email and bank, an authenticator app on nearly everything else, and text-message codes only where you have no better option. That’s the setup that holds up against the attacks people actually run today.

You don’t have to do all of it this afternoon. Move your email to a stronger factor first, since it protects everything downstream, then work outward from there. The move off SMS feels risky, but it isn’t, as long as you test the new method before you delete the old one.

If someone does get into an account, speed matters. Our guide to what to do if your email is hacked walks through recovery in order. A hacked social media account works a bit differently, and so does a SIM swap, the trick that makes text codes risky in the first place. Both are worth understanding before you lean on SMS anywhere important.

---

Tom Reardon spent over 20 years in product and operations at major identity protection providers. He writes at MyScamGuide.com to give consumers the honest picture the industry’s marketing never did.

---

Recommended resources:

• CISA: Require Multifactor Authentication: the federal ranking of MFA methods, strongest to weakest
• FTC: How To Recognize and Avoid Phishing Scams: how the code-relay trick actually works
• FCC: SIM Swap and Port-Out Fraud Rules: your carrier’s obligations, and what to ask them for