Two-factor authentication (2FA)

Two-factor authentication (2FA), a form of multi-factor authentication, is a login security step that requires two different types of proof of identity instead of a password alone. The Consumer Financial Protection Bureau describes multi-factor authentication as combining factors from separate categories: something a user knows, like a password, and something a user has, like a one-time code from a phone or an authenticator app. NIST’s digital identity guidelines describe the same requirement as proof of possession and control of two distinct authentication factors, not two pieces of evidence from the same category. A leaked or guessed password alone is not enough to sign in, since the second factor still has to be produced. For a financial app used to send, receive, or hold money, 2FA is a baseline defense against account takeover: even if a password is exposed through phishing or a data breach, the attacker still needs the second factor to gain access or authorize a transfer.

See also: KYC for the identity check apps run before a user can transact, and How are Moni balances protected if you lose your phone? for how account recovery works when a device, not just a password, goes missing.