Two-factor authentication (2FA)

Requiring a second proof of identity beyond the password, such as an SMS code, an authenticator app, or a hardware security key.

Two-factor authentication adds a second, independent check to a login. Something you know, the password, plus something you have, a phone or an authenticator app or a hardware key. If the password leaks, the account still holds.

SMS is the most common second factor and the weakest of the mainstream options, because phone numbers can be moved to another SIM by someone who convinces a carrier to do it.

The three kinds of second factor

SMS and voice codes travel over the phone network, so they depend on a number you control today and can be intercepted through carrier-level attacks. Authenticator apps compute codes on the device from a shared secret, so nothing crosses the network. Hardware keys sign a challenge over USB or NFC and also verify the site, which is what stops phishing.

US federal guidance has flagged SMS as the weakest of the three for years, while still treating it as better than a password alone.

What to do after verifying with a rented number

A rented number clears the gate at sign-up. It is not a home for ongoing two-factor codes, because the number returns to the pool after the activation.

On the same day you create the account, add a recovery email you own and switch the second factor to an authenticator app. The account then never depends on a line you held for a few minutes. Two-factor without a phone number walks through this for the main platforms.