With two-factor authentication (2FA), a leaked password alone isn't enough for anyone to get in. Here's how it differs from the often-confused two-step verification, and how the methods compare (no attack steps).
The difference between "two factors" and "two steps"
The words look alike, but it's simple once you hold the goal in mind. Authentication factors fall into three categories:
Two-factor authentication (2FA) mixes two different categories (e.g. password = knowledge + an authenticator app = possession). The point: if one is broken, a different category still stands, so an attacker can't get in.
Two-step verification (2SV), by contrast, only means "check twice," and both steps can be the same category (password + security question is two steps but not two factors). So if you truly want strength, the key is to mix different categories.
Method strength: it depends on whether a fake site can steal what you enter
Even with 2FA on, strength varies a lot by method. The decider is whether you could accidentally give the "proof" to a fake site.
Strong ── Passkey / security key (FIDO2)
Signature bound to the domain — structurally can't be presented to a fake site (phishing-resistant)
Medium ── Authenticator app (TOTP)
Stronger than SMS, but a human reads the code — so it can be handed to a fake site
Weak ── SMS / email codes
codes can be phished; SMS also faces phone-number takeover
Weak: SMS / email codes
- a human reads and types the code — so it can be handed straight to a fake site
- SIM swapping targets SMS or voice delivery to a phone number. Email codes instead depend on the mailbox and its recovery protections; both types of manually entered code can be phished.
- still clearly stronger than a password alone (far better than nothing)
Strong: passkey / security key (FIDO2)
- the signature is bound to the site's domain — impossible to present to a fake site
- For a passkey or security key used on its own as MFA, the service must require and verify user verification such as a PIN or biometrics. A security key can also be combined with a password; touch alone is not a second factor.
- an authenticator app (TOTP) sits in between — stronger than SMS, but still presentable to a fake site
2FA vs two-step verification vs MFA vs OTP vs passkey
There are many similar terms because words for an idea and words for a method get mixed together.
| Term | What it means | Example |
|---|---|---|
| Two-factor authentication (2FA) | The idea of combining two different kinds of proof | Password + authenticator-app code |
| Multi-factor authentication (MFA) | The idea of combining two or more different kinds of proof (includes 2FA) | domain-bound signature; PIN or biometrics when user verification is required |
| Two-step verification (2SV) | Checking twice (the two can be the same kind) | Password + security question |
| One-time password (OTP) | A single-use code often used as the second proof | Codes from an authenticator app, SMS, or email |
| Passkey | A login method that signs with a private key on your device | Unlocking with fingerprint or face to log in |
2FA and MFA describe what has to be satisfied; OTP and passkeys describe how it's satisfied. Codes are explained in what a one-time password (OTP) is, and signatures in what a passkey is. Even when a service's screen says "two-step verification," what's behind it is often 2FA such as password plus authenticator app, so judge by the actual method.
How much 2FA prevents
A 2023 study by Microsoft researchers analyzing users of the company's cloud found that accounts with MFA enabled had a 99.22% lower risk of compromise overall, and 98.56% lower even when leaked credentials were used. Most takeovers from password reuse or leaks are stopped just by turning on 2FA, whatever the method.
There are still things 2FA doesn't prevent.
- Typing into a fake site: SMS and authenticator-app codes entered on a fake site get relayed to the real one. Passkeys and hardware keys prevent this
- Weak recovery: if an account can be restored with only an SMS or the registered email, that becomes the way in
- Accounts without 2FA: if attackers get in through a work email or third-party service account without 2FA, your other defenses don't help
A disclosed incident: separate cause assessment from recommended controls
In its August 1, 2019 statement, the operating group assessed an attack using lists of illicitly obtained IDs and passwords as the likely cause. This is the company's assessment at that time, not a claim that every attack path had been established. The same statement said it had not found cases where external-ID integration, password reminders or chat-assisted password resets directly caused the unauthorized access. 808 people and ¥38,615,473, as of July 31, 2019 at 17:00, covering both unauthorized top-ups and unauthorized use. These are the dated figures in the August 1 disclosure, not a stated final total. 7pay fraud (2019).
Since then, more services make 2FA mandatory instead of leaving it to users. Starting in March 2023, GitHub has been progressively requiring 2FA for users who contribute code (setup in setting up GitHub 2FA). When we classified the major incidents disclosed in Japan in August 2026, more of them started from legitimate credentials — a contractor's Microsoft 365, work email, GitHub credentials — than from exploited vulnerabilities (how 2026 breaches in Japan got in).
How to check your own accounts
Decide the order
Start with email and your password manager, because both are used to reset or manage your other accounts. Then your domain, cloud, and GitHub, and then banking, brokerage, and payments.
Check each account's 2FA method
In the security settings, see whether 2FA is on and which method it uses. If it's an SMS or email code, add an authenticator app or a passkey and make it preferred. The methods are compared in choosing MFA the right way.
Prepare recovery codes and a second method
Save recovery codes somewhere other than your phone, such as your password manager. Register a second method too, such as a backup passkey or hardware key.
Review your recovery email and phone number
Confirm that the registered recovery email address and phone number are still yours, and that the recovery email account itself has 2FA. To check whether your password has already leaked, see how to check if your password has leaked.
If you manage others, make 2FA mandatory
For company email, GitHub organizations, and cloud admin consoles, don't leave 2FA optional; require it in the organization settings. Ask admin accounts to use passkeys or hardware keys.
This site's view: turn it on first, then move to methods you 'can't hand over'
The most common 2FA failure is overthinking "which is strongest" and ending up with none at all. The priority is clear: turn on some 2FA on every account first, then move your most important accounts (email, domain, payments) to a method you can't hand to a phishing site (passkeys).
This site does not count "spotting the fake site by being careful" as a defense strategy. Rather than human vigilance, lean on methods where the proof structurally can't be given to a fake site.
Sources (primary)
- NIST SP 800-63B-4, "Digital Identity Guidelines: Authentication and Authenticator Management" (July 2025) — pages.nist.gov (authentication factors, phishing resistance, phone-network methods restricted)
- Meyer et al., "How effective is multifactor authentication at deterring cyberattacks?" (Microsoft, 2023) — arxiv.org (MFA lowered compromise risk by 99.22%, and by 98.56% with leaked credentials)
- CISA, "Implementing Phishing-Resistant MFA" (October 2022) — cisa.gov (PDF) (MFA forms ranked strongest to weakest, SIM swaps targeting SMS)
- GitHub Docs, "About mandatory two-factor authentication" — docs.github.com (progressive requirement since March 2023)
- Operating group's notice on discontinuation, investigation and response (2019-08-01) — 7andi.com
Read next
- GitHub settings: How to set up GitHub two-factor authentication
- Glossary: what a one-time password (OTP) is (how authenticator-app codes work: TOTP/HOTP/SMS) · what a passkey is (the strongest method, which can't be handed to a fake site)
- Glossary: what phishing is (understand the AiTM attacks that target 2FA)
- Learn: choosing MFA the right way (method selection in practice)
- Case: 7pay fraud (2019)