Two-factor authentication

Two-factor authentication (2FA, sometimes MFA) is a login that needs two different proofs: something you know (password) plus something you have (phone app, SMS code, hardware key) or something you are (biometrics). A leaked password alone should not open the account.

It is a different layer from HTTPS / SSL (the padlock on the wire) and from a passkey (passwordless, phishing-resistant). Until passkeys cover every tool, 2FA is the practical extra lock on admin, Google Workspace, Microsoft 365, and e-commerce dashboards. Authenticator apps beat SMS when you can use them. Pair it with CAPTCHA on public logins so bots cannot spray stolen pairs at speed.

A real-life example of two-factor authentication

A Midtown shop’s Shopify password shows up in a dump from some other site. Without 2FA, the attacker is in the admin. With an authenticator prompt on the owner’s phone, the password is useless. Same idea as a store key plus a door code.

Turn it on for staff first, then customers if the platform supports it. Basics: Digital Security for Businesses and Web Wise: How Can I Keep My Website Secure?.