Two-factor authentication: add another layer without adding friction.

A compromised password should not be enough to enter an account. Multifactor authentication adds a second check and reduces dependence on a single credential.

What 2FA actually solves

The goal is to verify something beyond the password: a device, an authenticator, a physical key or a biometric characteristic. CISA recommends MFA for remote access and privileged accounts, with phishing-resistant methods where the risk warrants them.

A clear, controlled SMS flow

1. The user signs in with an identifier and password.
2. The system generates a short-lived, single-use code.
3. The code is delivered to the previously verified number.
4. The system limits attempts, records events and blocks abuse.
5. The user has a secure recovery path if phone access is lost.

Where the limits are

SMS codes can be affected by social engineering, SIM swaps and device changes. For administrators, finance, critical infrastructure or especially sensitive information, evaluate authenticators, passkeys or security keys.

Checklist before implementation

• Verify the number before enabling the method.
• Use random, short-lived and single-use codes.
• Apply rate, attempt and anomaly limits.
• Do not reveal whether an account exists in error messages.
• Design recovery, support and revocation from the start.
• Test accessibility, international delivery and mobile experience.