Browsers & Accounts · Passwords, Passkeys & Two-Step · Lesson 3 of 5

Two-Step Methods Compared

Text codes, authenticator apps, push prompts and security keys, weakest to strongest.

Four kinds of second step

Two-step verification, also called two-factor authentication or MFA (multi-factor authentication), adds a second check after your password. Any second step is far better than none. But they're not equally strong. Here are the four you'll see most, from weakest to strongest.

• Text message codes. The site texts you a short code to type in. Easy, and it works on any phone. Weakness: the code goes to your phone number, and a number can be stolen. A fake site can also ask for the code and use it right away.
• Authenticator apps. An app like Google Authenticator or Microsoft Authenticator shows a new six-digit code every 30 seconds. The code is made on your phone, so it never travels over the phone network. A fake site can still trick you into typing it.
• Push approvals. Your phone pops up "Are you trying to sign in?" and you tap Approve. Fast, but easy to approve by mistake. More on that next.
• Security keys and passkeys. A security key is a small device that plugs into a USB port or taps your phone. Like a passkey, it only works on the real site, so it can't be phished.

Remember the SIM swap from the Mobile track? A criminal talks your phone company into moving your number to their SIM card. From then on, your text codes go to them. That's the main reason experts rank text codes lowest.

So what should you use? For email and money accounts, choose a passkey or security key if offered, or an authenticator app. Keep text codes as a backup, or for accounts that offer nothing else. CISA, the US government's cybersecurity agency, calls FIDO methods like passkeys and security keys phishing-resistant and recommends them.

Push bombing and how to stop it

Push approvals have a weak spot. Suppose a criminal already has your password. They try to sign in, and your phone asks you to approve. You tap Deny. They try again. And again, late at night, dozens of times.

This is called MFA fatigue or push bombing. The criminal hopes you'll get tired, confused or half asleep and tap Approve just to make it stop. Sometimes they also call or text pretending to be support staff: "We're fixing your account, just approve the prompt."

Here's how to handle it:

• Never approve a sign-in you didn't start. If you didn't just try to sign in, the answer is always no.
• A flood of prompts means your password is known. Change it right away on the real site, then check your recent sign-in activity.
• Nobody real asks you to approve a prompt for them. Genuine support staff never need you to.
• Use number matching if it's offered. With number matching, the screen you're signing in on shows a number, and you type that number into your phone. You can't do that without seeing the sign-in screen, so a surprise prompt can't be approved by accident. Microsoft Authenticator works this way.

Many apps also show the place or device trying to sign in. If it's a city you're not in, that's another clear sign to refuse.

Passkeys and security keys avoid this problem, because there's no prompt that someone far away can send you. That's one more reason they sit at the top of the list.