Two-factor authentication (2FA)
A login security layer requiring both your password and a second factor (code from an authenticator app, SMS, or hardware key). Critical for protecting recovered accounts.
Two-factor authentication (2FA, sometimes 2-step verification) adds a second proof of identity beyond your password — usually a time-based code from an app, an SMS, or a hardware security key.
Why it matters for recovery
Most account takeovers we see happen because the victim had no 2FA, or had only SMS 2FA. Once you recover your account, enabling 2FA correctly is the single most important post-recovery step.
Types of 2FA, ranked by strength
- Hardware key (YubiKey, Titan) — strongest. Phishing-resistant.
- Authenticator app (Google Authenticator, Authy, 1Password) — strong. Codes rotate every 30 seconds.
- Backup codes — strong, but only if stored offline.
- SMS — weakest. Vulnerable to SIM-swap attacks. Better than nothing.
2FA lockouts
If you’re locked out because of 2FA — lost your phone, switched authenticator apps without backup codes — that’s a different recovery scenario from a hacked account. The appeal path involves proving account ownership and may take longer.