Two-factor authentication methods compared: SMS, email, apps and keys
Not all second factors are equal. How SMS codes, email codes, authenticator apps and hardware keys protect you — and where they fail.
Two-factor authentication (2FA) adds a second check to your password: something you have, not just something you know. The method you use matters.
SMS codes
A code is sent by text message. Easy to use, but vulnerable to SIM swapping — a criminal convinces a mobile operator to move your number to their SIM card — and to interception.
Email codes
A code is sent to your email. Its security depends entirely on your email account. If the email is well protected, this is a solid second factor; if someone controls your email, they get the codes too. XFasil's two-factor authentication uses email codes — read Protecting your email account.
Authenticator apps
Apps generate a new code every 30 seconds from a secret stored on your phone (the TOTP standard). Codes do not travel over the phone network, so SIM swapping does not help an attacker. Back up the recovery codes when you set them up.
Hardware security keys
Small USB or NFC devices that sign a challenge from the website (the FIDO2 / WebAuthn standards). They check the website's address, which makes them highly resistant to phishing.
What none of them stop
- Giving your code to a scammer on the phone or in a chat.
- Signing in on a fake website that relays your code in real time.
- Malware on your computer.
XFasil staff never ask for your codes. Turn on two-factor authentication in Account → Security and read the Security Center.
Blog posts are for education and information only and are not investment, legal or tax advice.