Two-factor authentication for money accounts

What is two-factor authentication?

The Federal Trade Commission defines 2FA as needing credentials from two of three categories to log in:

• Something you know, such as a password, a PIN or a security answer.
• Something you have, such as a one-time code sent by text or email, a code from an authenticator app, or a physical security key.
• Something you are, such as a fingerprint or your face.

The point is that one stolen secret is no longer enough. Passwords leak in data breaches and get typed into fake pages; a second factor of a different kind means the attacker also needs your phone, your key or your face. CISA puts it simply: weak or stolen passwords are a common way in for criminals.

For money accounts, such as a bank, a broker or a crypto exchange, 2FA is the minimum. It also matters for your email, because email is where password resets land.

Which type of 2FA is the most secure?

US agencies agree on the order. CISA's fact sheet ranks phishing-resistant methods first and SMS last; the FTC calls security keys the strongest option because they use no credential a hacker can steal.

NIST's 2025 digital identity guidelines go further and label authentication over the phone network, meaning SMS and voice, as restricted, advising services to watch for SIM changes and number porting before trusting it.

Why can a code still be phished?

A one-time code proves you have the phone, but not which website you are typing it into. A phishing page can ask for your password and your current code, then pass both to the real site within seconds. NIST lists passwords, one-time codes and out-of-band approvals among authenticators that are not phishing-resistant.

Passkeys and security keys work differently. The FIDO Alliance explains that they use public-key cryptography and are bound to the specific website or app. A key registered for your bank's real domain will not produce a valid login for a lookalike domain, however convincing it looks.

How should you set up 2FA on your money accounts?

1. Start with your email. Whoever controls your inbox can reset most other passwords.

2. Then your bank, broker and any crypto exchange. Choose the strongest method each one offers: a passkey or security key first, an authenticator app second, SMS only if nothing else is available.

3. Use long, unique passwords. NIST's guidelines set a minimum of 15 characters for a password used on its own and drop forced complexity rules. Ethereum.org strongly recommends a password manager.

4. Plan for a lost phone or key. Register a second key or method where the service allows it, and store any backup codes offline, the way you would a seed phrase.

5. Remove SMS as a fallback once a stronger method is working, if the service lets you. A strong front door is weaker if a texted code still opens the side door.

What 2FA mistakes do beginners make?

• Approving a prompt you did not start. CISA describes push bombing: attackers who already have the password send prompt after prompt until the victim taps Approve. If you did not just try to log in, deny it and change the password.
• Reading a code to a caller. The FTC says some of the costliest impersonation scams start with a fake security alert, often claiming to be from your bank. Treat any caller who asks for a login code as an impostor: the code exists to prove that you, not they, are signing in.
• Treating SMS as strong. Ethereum.org says SMS-based 2FA is susceptible to SIM swapping and calls it not secure.
• Protecting the exchange but not the email. Reset links make your inbox the master key to everything else.
• Thinking 2FA protects a self-custody wallet. 2FA guards logins at companies. A wallet you control is guarded by its seed phrase and by what you sign; see hardware vs software wallets.