2FA (Two-Factor Authentication) is a login or approval check that requires two proofs of identity from different categories: something the user knows, such as a password or PIN, something they have, such as a phone or hardware key, or something they are, such as a fingerprint. Two passwords do not qualify because both can be stolen the same way. The second factor is usually an SMS code, an authenticator-app code, a push approval or a hardware key bound to an enrolled device. Hardware keys and passkeys resist phishing; SMS codes are the weakest common option. In the EU and UK, PSD2 makes strong customer authentication mandatory for payment logins and transactions.
How does 2FA work
The user enters the first factor, usually a password, and the service then asks for the second. The common second factors are a one-time code sent by SMS, a code generated by an authenticator app (TOTP, refreshed every 30 seconds), a push notification to a registered banking app, or a hardware security key using FIDO2/WebAuthn. The code or signature is bound to a device the user enrolled earlier, so a stolen password alone no longer opens the account.
Hardware keys and passkeys are phishing-resistant: the cryptographic response is tied to the website's domain, so a fake login page cannot relay it. SMS codes and app codes can be typed into a phishing site and replayed by an attacker within seconds.
Is SMS 2FA secure
It is the weakest common option. NIST's digital identity guidelines (SP 800-63B-4, final version published 31 July 2025) classify one-time codes over the phone network as a "restricted" authenticator, require services using them to offer an alternative, and tell verifiers to check for SIM swaps and number porting before sending a code. The same guidelines require services at assurance level AAL2 to offer at least one phishing-resistant option.
2FA vs SCA in payments
In the EU and UK, payment providers do not choose whether to use 2FA. PSD2 requires strong customer authentication when a customer logs in to a payment account online or initiates an electronic payment, and the Regulatory Technical Standards set the details. After no more than five consecutive failed attempts, the action must be blocked; an online banking session must time out after no more than 5 minutes of inactivity; and a failed attempt must not reveal which of the two elements was wrong.
The RTS also allow exemptions. Since an amendment applying from 25 July 2023, a bank must not demand full re-authentication more often than every 180 days when a customer views account information through a regulated AISP, up from 90 days. Card payments online use 3-D Secure as the channel for this second factor.
Example: what weak 2FA costs
Take an illustrative e-money institution with 40,000 customers where 2% are hit by SIM-swap fraud in a year and the average loss refunded is £600. That is 800 cases and £480,000 in reimbursements, before complaint-handling costs and regulator attention. Moving high-risk actions, such as adding a new payee, to in-app push approval bound to the device removes the SIM as the point of attack.
For a buyer of a licensed payment or e-money firm, the authentication stack is a due diligence item: which factors are used for login, payee changes and card enrolment, failed-attempt logs, and whether fraud refunds tie back to SMS-only flows.