Two-factor authentication: which kind actually protects a crypto account

Two-factor authentication means proving two different things: something you know and something you have. It is the single most effective thing you can add to an account, and the method you choose changes how much it is worth.

A code by text is tied to your phone number, not your phone. A number can be moved to someone else's SIM by convincing a mobile operator to do it — a SIM swap — and operators have been convinced many times.

Crypto accounts are a favourite target for exactly this, because the funds move instantly and irreversibly once the attacker is in. If a service offers nothing else, use SMS; if it offers an alternative, take the alternative.

An app on your device generates a six-digit code from a shared secret and the clock. Nothing is sent over the network, so there is no message to intercept and no operator to social-engineer.

Save the backup codes when you set it up. Losing the phone without them is how people lock themselves out, and it is a far more common failure than being hacked.

A hardware key, or a passkey stored in your device's secure hardware, is the strongest widely available option. It is also the only one that resists phishing, because the key checks which site is asking before it responds.

That property matters more than it sounds. A code can be typed into a convincing fake site. A passkey cannot, because the fake site has the wrong domain and the key simply refuses.

Secure the email address on the account first. Account recovery almost always runs through email, so an attacker with your inbox does not need your second factor — they can reset their way past it.

Use a unique password per account, from a password manager. Reuse is still the most common way accounts are lost, and no second factor helps if the attacker gets in through a path that does not ask for one.