How two-factor authentication works
The first factor is usually a password or a PIN. The second is commonly one of these:
- A one-time code sent by SMS or email
- A code from an authenticator app, generated from a shared secret and the time
- A push notification approved in a registered app
- A hardware security key or a passkey, which signs a challenge
- A fingerprint or face check on a bound device
Not every second factor is equal
A code that a person reads and types can be phished: a fake page asks for the code and replays it within seconds. SMS codes are also exposed to SIM swap fraud, in which the attacker takes over the phone number.
Factors that sign a challenge tied to the genuine site or app, such as security keys, passkeys and approvals on a bound device, resist that attack. Two items of knowledge, a password and a memorable word, are not two factors.
Two-factor authentication and the rules for payments
PCI SSC's glossary defines multi-factor authentication as verifying at least two factors: something the user has, something the user knows, or something the user is or does.
In EU payments law the counterpart is strong customer authentication, which asks for more than general 2FA does. The elements have to be independent, so that the breach of one does not compromise the others, and for a remote electronic payment the authentication is dynamically linked to the amount and the payee (PSD2, Articles 4(30) and 97).
2FA, MFA or two-step verification?
- Multi-factor authentication
- Two or more factors. 2FA is the case of exactly two, and in practice the words are used interchangeably.
- Two-step verification
- Two steps that may be of the same kind, such as a password and then a code sent to an email account. Weaker than two factors of different kinds.
- Strong customer authentication
- The legal standard for payments in the EU, with its own rules on independence, dynamic linking and exemptions.
Where two-factor authentication shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- NotificationsEmail, SMS, push and in-app messages in your brand, through the providers you choose.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- PCI SSC, Glossary: Multi-Factor Authentication
- Directive (EU) 2015/2366, PSD2, Articles 4(30) and 97 (EUR-Lex)
General information, not legal advice: what applies to you depends on your services and your market.