Two-factor authentication, usually shortened to 2FA, is a security method that requires you to prove your identity in two separate ways before you can access an account. Most of us are used to a single password. Two-factor authentication adds a second check, so that even if someone steals your password, they still can't get in without that second piece of proof. It's one of the most practical security upgrades available to everyday users, and it's free to set up on most platforms.
Why a password alone isn't enough
Passwords get stolen. They get reused across sites, leaked in data breaches, guessed by automated tools, or phished out of users through fake login pages. The Australian Cyber Security Centre reported that credential-based attacks are among the most common incidents it responds to. A strong password helps, but it's still a single point of failure. If it leaks, your account is open.
Two-factor authentication changes that equation. A thief who gets your password still needs a second thing: a code from your phone, a fingerprint scan, or a physical key. They're unlikely to have all of these at once. That's what makes 2FA effective.
This logic sits at the heart of broader cybersecurity practice, where layered defences are always stronger than any single safeguard.
How two-factor authentication actually works
The three classic categories of authentication factors are: something you know (a password or PIN), something you have (a phone or hardware key), and something you are (a fingerprint or face scan). Two-factor authentication combines any two of these. Most consumer implementations use the first two: your password plus a temporary code sent to your phone.
Here's the typical flow for a standard 2FA login:
- You enter your username and password as usual.
- The service recognises your credentials and sends a six-digit code to your phone, either by SMS or through an authenticator app.
- You type in that code within a short window (usually 30 seconds for app-generated codes).
- Access granted.
The code expires quickly, so even if someone intercepts it, it's useless within seconds.
SMS codes vs authenticator apps
SMS is the most common 2FA method because it requires nothing extra beyond a mobile number. You get a text, you type the code. Simple. But SMS has a real weakness: SIM swapping. This is when a scammer convinces a mobile carrier to transfer your number to a SIM card they control. From that point, they receive your SMS codes.
Authenticator apps are considerably more secure. Apps like Google Authenticator and Authy generate codes locally on your device without sending anything over a network. There's nothing for a scammer to intercept. The codes are based on a shared secret and the current time, calculated entirely on your phone. No mobile signal required, no SIM swap vulnerability.
For most people, switching from SMS to an authenticator app is the single most impactful upgrade they can make to their account security. It takes about five minutes per account to set up.
Hardware security keys: the gold standard
For high-value accounts, physical hardware keys provide the strongest protection. A hardware key is a small USB or NFC device you plug in or tap to your phone to complete login. It works using a cryptographic challenge-response, meaning it can't be phished. Even if you're tricked into visiting a fake login page, the key won't authenticate because the site domain doesn't match.
Google, Cloudflare, and a number of financial institutions now support or require hardware keys for sensitive access. The YubiKey is the most widely recognised consumer hardware key, and it works across Google, Microsoft, GitHub, and dozens of other platforms. The cost is roughly $60 to $100 for a pair (you should always have a backup).
Hardware keys are niche for a reason: they require physical access and careful management. Losing your key without a backup means a painful account recovery process. But for journalists, executives, healthcare workers, and anyone handling sensitive data, they're worth the effort.
Which accounts should you protect first?
Not every account carries the same risk. Prioritise the ones that, if compromised, could cause the most damage or unlock others. Email is the most critical. If an attacker controls your email account, they can reset passwords on everything else tied to it. Banking and superannuation accounts come next, followed by your mobile account (because of the SIM swap risk) and any accounts that store payment details.
Social media accounts are worth protecting too, particularly if you use them for work or have a public following. A hijacked LinkedIn or Instagram account can be used to scam your contacts. Enable 2FA on all of them, but start with email and banking today.
Understanding layered digital security is closely related to how a VPN protects your connection: both are tools that narrow the attack surface an adversary has to work with.
Common mistakes when setting up 2FA
The biggest mistake is not saving backup codes. When you enable 2FA, most services generate a set of one-time recovery codes. These let you get back in if you lose your phone. Most people dismiss the prompt and never save them. Store these in a password manager or print them and keep them somewhere secure.
The second mistake is linking 2FA to the same device as your password manager. If your phone is stolen and both your passwords and your authenticator app are on it, a determined attacker may still get through. Separating these, or using a hardware key, eliminates that risk.
The third mistake is treating SMS 2FA as final. It's better than nothing, but don't leave it there. Move to an authenticator app when you get the chance.
Passkeys: what comes after 2FA
Passkeys are a newer standard that effectively combines authentication factors into one step. Rather than a password plus a code, a passkey uses a cryptographic key pair: your device holds the private key, and the service holds the public one. You authenticate with biometrics (face ID or fingerprint) on your device, and the whole exchange is cryptographically signed. No password to steal. No code to intercept.
Apple, Google, and Microsoft have all built passkey support into their operating systems. Adoption among websites and apps is growing steadily. Passkeys don't replace the need to understand 2FA today, because most services still rely on it, but they point toward a future where the password as a concept largely disappears.
For now, enabling two-factor authentication on your key accounts remains the most concrete and immediate step any Australian can take to reduce their exposure online. Set it up on your email account first. It takes less time than it sounds.