# two-factor-authentication

Source: https://startwithidentity.com/glossary/two-factor-authentication/
Last updated: 2026-10-17
License: content by Start with Identity. Cite the source URL.

---

Two-factor authentication (2FA) is sign-in that requires two distinct types of authentication factor, typically a password (something you know) plus a phone, code generator or security key (something you have), which makes it the most common form of [multi-factor authentication](https://startwithidentity.com/glossary/mfa/). [NIST SP 800-63-4](https://pages.nist.gov/800-63-4/sp800-63.html) defines MFA as "an authentication system that requires more than one distinct type of authentication factor" and notes that a password plus a PIN is not two factors, because both are something you know.

The label says nothing about which second factor is in use, and that is where 2FA succeeds or fails. An SMS code, an authenticator-app code and a push approval all count as 2FA, and all can be handed to an attacker by a person who believes the request is genuine: in August 2026 the AnonyMousKIT kit used [a rented AI voice agent to phone theft victims and ask for their 2FA code](https://startwithidentity.com/blog/2026-08-26-anonymouskit-ai-voice-agent-phishes-apple-passcodes-and-2fa/). A passkey or FIDO2 security key is also a second factor but cannot be read aloud or typed into a fake page, which is why policies should name the method class ([phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/)) rather than just require "2FA".

See also: [MFA](https://startwithidentity.com/glossary/mfa/), [one-time password](https://startwithidentity.com/glossary/one-time-password/), [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/), [AAL](https://startwithidentity.com/glossary/aal/), [MFA implementation best practices](https://startwithidentity.com/guides/authentication/mfa-implementation-best-practices/)