Two-Factor Authentication (2FA)

Overview

Two-Factor Authentication (2FA) is a security process that requires users to provide two distinct forms of verification before accessing an account or completing a transaction. Typically, it combines something the user knows (like a password or PIN) with something the user has (such as a mobile phone, token, or one-time password). By adding this extra layer, 2FA significantly reduces the risk of unauthorized access, even if one factor like a password is compromised.

It is widely used by banks, fintechs, and digital platforms to protect sensitive accounts, secure online payments, and meet regulatory requirements, including Strong Customer Authentication (SCA) under the EU’s PSD2. Compared to single-factor authentication, 2FA offers stronger protection but is simpler than full multi-factor authentication (MFA). It is also considered a step toward passwordless authentication, where users rely on device-based or biometric factors instead of traditional credentials.