# What is 2FA (two-factor authentication)?

> Two-factor authentication (2FA) requires a user to prove their identity with two independent factors before access is granted — typically something they know (a password) and something they have (a phone receiving an OTP). SMS OTP is the most widely deployed second factor in the world. 2FA sharply reduces account-takeover risk, because a stolen password alone is no longer enough to log in.

- Canonical URL: https://www.broadnet.me/answers/what-is-2fa
- Language: en
- Last reviewed: 2026-07-22
- Publisher: BroadNet (https://www.broadnet.me)

## The factor categories

Authentication factors fall into three groups: something you know (password, PIN), something you have (phone, hardware token, passkey), and something you are (fingerprint, face). 2FA combines exactly two of these; MFA (multi-factor) combines two or more. SMS OTP pairs a password with possession of the phone. See /answers/what-is-otp.

## Delivery channels and their trade-offs

SMS OTP has the widest reach but is exposed to SIM-swap and AIT abuse; authenticator-app TOTP is phishing-resistant but needs setup; WhatsApp, voice, and Flash Call OTP add reach and cost options; passkeys remove the shared secret entirely. Robust systems fail over across channels in one call. See /answers/what-is-flash-call-verification and /products/myotp.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [What is OTP?](https://www.broadnet.me/answers/what-is-otp)
- [Two-factor authentication vs multi-factor authentication — what's the difference?](https://www.broadnet.me/answers/what-is-two-factor-vs-mfa)
- [What is Flash Call verification?](https://www.broadnet.me/answers/what-is-flash-call-verification)
- [What is AIT (Artificially Inflated Traffic)?](https://www.broadnet.me/answers/what-is-ait)
- [What is GSMA Open Gateway?](https://www.broadnet.me/answers/gsma-open-gateway)
- [OTP service](https://www.broadnet.me/products/otp)
- [MyOTP](https://www.broadnet.me/products/myotp)