What is 2FA?

Imagine someone has copied the key to your front door, but to get in they also need a card you keep in your pocket. That’s roughly how 2FA, short for two-factor authentication, works: your password alone isn’t enough to open the door.

Factors fall into three main categories: something you know, like a password; something you have, like a security key; and something you are, like your fingerprint. Real 2FA requires two different categories. Two passwords you’ve memorized don’t do the same job.

In practice, an exchange may first ask for your password and then for a temporary code from an authenticator app on your phone. The app generates codes that change periodically and usually works offline. Other options are SMS or a physical security key, depending on what the service supports.

Why it matters

If your password leaks, 2FA adds an extra barrier to accessing your account. Exchanges may also require it for withdrawals or for changes to security settings. We consider it a basic protective measure, not a guarantee that an account can’t be compromised.

There is one critical difference, though: 2FA doesn’t automatically protect a wallet’s private keys. If someone gets hold of your seed phrase (recovery phrase), they can usually restore the wallet somewhere else, bypassing the lock on your own app.

What to watch out for

Not all methods offer the same protection. SMS is vulnerable to scams that move your number to another SIM card (SIM swapping). Authenticator app codes can also be stolen through fake login pages. Compatible FIDO2 security keys offer stronger resistance to these phishing attacks.

Keep your backup recovery codes in a safe place, separate from your device. Before you switch phones, check how to transfer your authenticator app. Never share temporary codes with anyone claiming to be “support,” and never approve login requests you didn’t start yourself.