Two-Factor Authentication

Two-Factor Authentication

Two-Factor Authentication

Two-factor authentication – often abbreviated to 2FA – is when a second step is added to the process of logging into your online accounts which require confidentiality, as an additional security layer. These include your email accounts, bank accounts, social media and other websites where you have to log in securely with a username (or email address) and password. It helps to prove that it really is you who is trying to access your account. 

The most important accounts on which you should have two-factor authentication are your bank accounts and your email, the latter as it is the gateway to all your other online accounts. You are also required to protect your accounts by some government departments such as HMRC.

How it works

Two-factor authentication is generally carried out by typing in a four or six-numeral code sent to you by text message or email, or generated by a mobile app, or increasingly, by a face or fingerprint (biometric) scan. Security can be further increased by the application of multi-factor authentication (MFA) which typically combines entering a code and having a biometric scan. In some cases, it is carried out by plugging in a security key (a special kind of USB stick) or generating a code on a hand-held keypad supplied by your bank or other organisation.

Why it is necessary

There are a number of reasons why two or multi-factor authentication has become increasingly necessary, all based on password security. If a criminal gains access to your login details (combination of username or email address and password), they have free rein to gain access to any of your online accounts to steal your money or commit identity theft. They obtain these login details in three main ways:

If someone has obtained your passwords in any of these ways, it is unlikely they will be able to gain access to your accounts unless they have unlocked access to the device to which the authentication code has been sent. If the authentication factor is biometric, they would need to be able to scan your face or fingerprint on the device registered on your account.

It is also possible for a criminal to overcome two-factor authentication by carrying out a SIM-swapping attack, where they impersonate you to convince your mobile network to provide them with a SIM in your name – and with your mobile number – to enable them to obtain our two-factor authentication codes. No security is infallible, setting up two-factor authentication on an online account will certainly help to prevent unauthorised access.

Advice