Two-factor authentication, or 2FA, requires a second proof of identity beyond your password before an account will open. The password is something you know. The second factor is something you have, usually a phone or a small hardware key. In crypto it matters more than almost anywhere else, because a drained exchange account cannot be charged back and a sent transaction cannot be reversed.
Why a password alone fails
Constantly, and mostly not through your fault, passwords leak.
In breaches of unrelated services they leak, get reused across sites, get guessed when weak, and get captured by malware. Once a password is out, it works from anywhere in the world, and nothing about it tells the platform that the person typing it is not you.
A second factor breaks that. With your password alone, an attacker still needs physical access to a device you are holding. That single requirement stops the overwhelming majority of account takeovers.
Types of 2FA ranked by strength
Not all 2FA is equal, and the gap between the strongest and weakest option is wide enough that treating them as interchangeable is itself a security mistake.
| Method | How it works | Strength |
|---|---|---|
| Hardware security key or passkey | A physical device or a key tied to your phone, verified cryptographically | Strongest |
| Authenticator app | A rotating six-digit code generated on your device | Strong |
| Email codes | A code sent to your inbox | Weak, and only as strong as the inbox |
| SMS codes | A code sent by text message | Weakest |
Why SMS 2FA is vulnerable to SIM swapping
SIM swapping. That is the whole answer.
An attacker contacts your mobile carrier, impersonates you using details gathered from breaches and social media, and persuades support to move your number to a SIM card they control. Your phone loses service. On their phone arrive your text messages, including every 2FA code.
Nothing about that attack requires touching your device or your password reset flow. At the carrier's customer service it aims, which is the weakest link in the chain and not one you control.
Carriers have added protections such as port-out PINs, and they help. Of the common methods, SMS remains the one most worth moving away from. It is still far better than no second factor at all.
How an authenticator app works
Better, and simpler than people expect.
At setup, the platform shows a QR code containing a shared secret. Storing that secret, your app combines it with the current time to generate a six-digit code that changes every 30 seconds. The platform runs the same calculation and checks the codes match.
After setup, the secret never travels over the network, which is why there is nothing for an attacker to intercept. No SIM to swap, no message to redirect.
Recovery is the catch. Lose the phone without a backup and you lose access. Save the backup codes the platform gives you at setup, offline, in the same place you would keep anything else you cannot replace.
Hardware keys and passkeys
Strongest of the options, and the only one that defeats phishing outright.
Plugging in or tapping, a hardware security key is a small physical device. A passkey applies the same cryptography, tied to your phone or computer instead of separate hardware.
Both do something an authenticator app cannot: they verify the website's identity before responding. Landing on a convincing fake exchange page, you find the key simply refuses to work, because the domain does not match what it was registered to. A six-digit code, by contrast, gets typed straight into the fake site by a person who believes it is real.
Because of that property, hardware keys and passkeys are the only 2FA method that meaningfully resists phishing rather than just password theft.
What 2FA does not protect
Being clear about the limits, since 2FA gets treated as complete security.
- Your email. If an attacker controls your inbox, they can usually reset everything downstream through password recovery. Use a dedicated address for crypto accounts and secure it to the same standard.
- Malicious signatures. A wallet drainer needs no password and no 2FA. You approve the transaction yourself.
- Self-custody wallets. A seed phrase has no second factor. Whoever holds the words holds the funds.
- Approved sessions. A logged-in session on a compromised device may not prompt for 2FA again.
- Social engineering. Someone calling as support and talking you through reading out a code defeats every method except hardware keys.
How to set up 2FA: practical steps
- Use an authenticator app or a hardware key. Move off SMS where the platform allows it.
- Store backup codes offline, in more than one place.
- Use a dedicated email address for exchange and wallet accounts, protected with the same standard of 2FA.
- Turn on withdrawal address allowlisting where supported, so funds can only leave to destinations you pre-approved.
- Add a port-out PIN with your mobile carrier if you must keep SMS as a fallback.
- Never read a code aloud to anyone, for any reason. No legitimate support process needs it.
Security you can verify on mb.io
Directly under your control is account security, and it works best alongside a platform that adds controls of its own.
mb.io is a regulated crypto spot exchange backed by MultiBank Group, a financial institution founded in 2005 that serves more than 2 million clients across 100+ countries.
- Withdrawal controls that let you verify a destination before funds move
- Institutional-grade MPC custody powered by Fireblocks, with segregated client funds
- 10/10 security score from Hacken, an independent blockchain security auditor
- Regulated by VARA in the UAE and AUSTRAC in Australia
- Buy, sell, and swap in three steps, from sign-up to purchase
- 24/7 multilingual client support
Open your account and start trading on mb.io.
Frequently asked questions
What is two-factor authentication?
A security method requiring a second proof of identity beyond your password, usually a code from an app or a physical key. With it, a stolen password alone is not enough to open your account.
What is the best 2FA method for crypto?
A hardware security key or passkey, because it verifies the website's identity and refuses to respond to a fake one. Next best is an authenticator app. Weakest of the common options is SMS.
Why is SMS 2FA considered unsafe?
Because of SIM swapping, where an attacker persuades your mobile carrier to transfer your number to their SIM card. On their phone your codes then arrive. At carrier support the attack aims, rather than anything you control.
How does an authenticator app work?
At setup it stores a shared secret from a QR code, then combines that secret with the current time to generate a six-digit code every 30 seconds. Afterward the secret never travels over the network, so there is nothing to intercept.
What happens if I lose my 2FA device?
Use the backup codes provided at setup. Without them, recovery depends on the platform's identity verification process, which can take time and sometimes fails entirely.
Does 2FA protect my crypto wallet?
Not a self-custody wallet. On a seed phrase there is no second factor. 2FA protects accounts on exchanges and services, which is a different layer from on-chain wallets.
Can 2FA be phished?
Codes can. Asking for your six-digit code, a fake site can use it immediately. Hardware keys and passkeys resist this because they check the site's domain before responding.
Is 2FA enough on its own?
No. Against stolen passwords it protects, and against malicious transaction signatures, compromised email, or someone talking you into reading a code aloud, it does nothing.
