The first time a client called me in a panic because their Facebook Business Manager had been hijacked, I did what most people do: I asked whether they had two-factor authentication enabled. Long silence. Then: "The code thing? No, I always found it annoying."
Their ad account had been drained in under an hour. Roughly £4,000 gone, and Meta's recovery process took eleven days. Eleven days of not running campaigns, not answering client questions, not sleeping well.
That call changed how I think about two-factor authentication. Not as a security checkbox you tick once and forget, but as the single cheapest insurance policy you'll ever buy. This article explains how 2FA actually works, why it has become non-negotiable, and—honestly—where it still frustrates the hell out of me.
Key Takeaways
- 2FA requires two different types of proof: something you know, plus something you have or are.
- A stolen password alone becomes useless to an attacker once 2FA is active.
- Not all second factors are equal—SMS codes are the weakest, hardware keys the strongest.
- Push-notification fatigue and SIM-swapping are real attack methods, not theoretical risks.
- Losing your second factor can lock you out of your own account, so always set up backup codes.
- Almost every major platform—Google, Microsoft, Facebook, your bank—offers it for free.
Two-factor authentication explained: what actually happens when you log in
You type your password. The system accepts it but doesn't let you in yet. Instead, it asks for a second, completely different piece of evidence. Only when both checks pass does the door open.
The principle sounds trivial. It isn't, because the two factors must belong to different categories. Typing your password twice is not 2FA. Typing your password and then answering a security question is arguably not either, since both rely on knowledge an attacker might dig up or guess.
The three factor categories
- Something you know — a password, a PIN, a pattern
- Something you have — your phone, a hardware security key, a smart card
- Something you are — a fingerprint, your face, your voice
Two-factor authentication combines exactly two of these. Add a third and you're into multi-factor authentication territory, or MFA. In everyday speech people use the terms interchangeably, which is fine, though pedants will correct you.
How does two-factor authentication work under the hood?
Here's the part most explanations skip. When you enable 2FA on a service like Google or Microsoft, the server generates a shared secret—a long string of characters—and hands it to your authenticator app, usually by scanning a QR code. That secret never travels over the network again.
Your app and the server then independently run the same mathematical formula on that secret plus the current time. Every thirty seconds, both produce a new six-digit number. If the numbers match when you type yours in, you're verified. No internet connection required on your phone, which is why authenticator apps work fine on a plane.
This is a genuine improvement over SMS codes, which travel through phone networks and can be intercepted. More on that shortly.
Why is two-factor authentication so important?
Because passwords leak. Constantly. Not through sophisticated movie-style hacking, but through database breaches, phishing pages that look identical to the real login screen, and—most commonly—reuse across sites.
Consider what happens when a breach dumps a few million email-and-password pairs. Attackers don't manually test each one. They run automated scripts that try those credentials against hundreds of popular services within minutes. If you used the same password on your email and an old forum that got compromised in 2019, you're in the blast radius.
With 2FA enabled, that automated attack hits a wall. The script has your password but no way to produce the rotating code. The attack fails, quietly, and you never even know it happened.
Why does everything need two-factor authentication now?
Two shifts explain this. First, your email account has become the master key to your digital life—password resets for everything else flow through it. Protect the email, and you protect the rest.
Second, attackers got better at social engineering. Convincing a helpdesk to reset a password is often easier than cracking one. My hijacked client, it turned out, had clicked a link in a message that looked exactly like a Meta notification. They entered their credentials on a convincing fake page. Game over.
That's why banks, cloud providers, social networks and even gaming platforms now push 2FA hard, sometimes making it mandatory for business accounts.
A concrete example: my own near-miss
Two years ago I received a push notification at 2am asking me to approve a login to my Microsoft 365 account. I hadn't tried to log in. I tapped "deny" and went back to sleep.
Over the next twenty minutes, fourteen more notifications arrived. Someone had my password and was hammering the approve button, hoping I'd tap yes out of fatigue or confusion.
This is called MFA fatigue, and it works more often than you'd think. I changed my password the next morning and switched that account to an authenticator app instead of push approvals.
Two-factor authentication examples you'll actually encounter
Let me walk through the main flavours, because they are absolutely not equal in security.
| Method | How it works | Security level | Friction |
|---|---|---|---|
| SMS code | Six-digit text message | Weak | Low |
| Authenticator app | Rotating code generated offline | Strong | Medium |
| Push notification | Approve or deny on your phone | Medium | Very low |
| Hardware key | Physical USB or NFC device | Very strong | Medium |
| Passkey | Device-bound cryptographic credential | Very strong | Very low |
Which authenticator app should you use?
Google Authenticator, Microsoft Authenticator, Authy and 1Password all do the job. I've used Google's for years and it's fine—bare, fast, unglamorous. Microsoft's adds a handy backup and sync feature if you juggle multiple devices.
One warning from experience: if you lose the phone and have no backup, you lose access. I watched a colleague spend three weeks recovering a cryptocurrency exchange account because they'd never exported their recovery codes. Print them. Store them somewhere physical.
Setting it up on Facebook and Microsoft
The paths are similar everywhere. For Facebook: Settings and privacy, then Security and login, then Two-factor authentication. You'll choose between a text message, an authenticator app, or a security key.
For Microsoft accounts, head to Security, then Advanced security options. From there you can add a sign-in method and set a default. If you administer a business tenant, expect to configure this centrally for everyone through the admin portal.
And yes, that includes Fortnite and other gaming accounts. Epic Games added 2FA years ago, and it's especially worth enabling if you've ever bought in-game currency—accounts with stored value get targeted hard.
The downsides of two-factor authentication (yes, they exist)
I'm not going to pretend 2FA is painless. It isn't, and the industry's habit of glossing over the friction does nobody favours.
The biggest practical problem is lockout. Lose your phone, break it, or wipe it without a backup, and you may find yourself locked out of accounts you've used for a decade. Support processes for recovering access are often slow, sometimes impossible, and always stressful.
Then there's the SIM-swap attack. An attacker convinces your mobile carrier to transfer your number to a SIM they control, and every SMS code now lands in their hands. This requires effort and sometimes inside help at the carrier, but it happens—particularly to people with visible public profiles or valuable accounts.
Add to that:
- Small time cost on every single login
- Occasional code delays when travelling abroad
- Confusion for less technical users, especially in shared households
- The genuine risk of approving a malicious login by accident during a fatigue attack
Can you reduce the friction without giving up the protection?
Yes. Mark your main devices as trusted so you're not challenged every day. Choose push or passkeys over typing codes when the option exists. And check "remember this device" carefully—only on hardware you control.
In my opinion, the honest trade-off is this: a few extra seconds per login versus an entire weekend spent recovering a hijacked account. I've done both, and I know which one I'd pick every time.
The one scenario where I'd genuinely reconsider is a shared device in a household where nobody else understands what that approval prompt means. In that case, configure it for the account owner only and write the recovery codes down somewhere the family can find them in an emergency.
How to turn on two-factor authentication without locking yourself out
The order matters more than people realise. Do it wrong and you can trap yourself outside your own account.
- Open your account's security settings and locate the 2FA or two-step verification option.
- Choose your primary method—an authenticator app is the sensible default for most people.
- Scan the QR code, then enter the generated code to confirm the setup worked.
- Download and store your backup codes immediately. Print them or save them in a password manager. This is the step everyone skips and everyone regrets.
- Add a second method as a fallback, ideally a different category—a hardware key alongside the app, for instance.
- Test the whole flow by logging out and back in before you close the settings page.
Do this for your email first, then your bank, then social and cloud accounts. Email is the priority because it unlocks everything else.
The question worth sitting with
Here's what nags at me. Most people who get compromised had the tools available and simply didn't switch them on. The barrier was never technical. It was a few minutes of mild inconvenience versus a vague sense that "it won't happen to me."
If you're reading this and your email account still relies on a password alone, you already know what the next step is. Do it today, not next month. And when the approval prompt appears on your phone at 2am for a login you didn't request—deny it, then change your password immediately.
That prompt is not an annoyance. It's the system telling you someone is trying the door.
