Choose the right two-factor authentication method

The short answer: Any second factor can stop many password-only attacks, but methods differ when an attacker controls a phone number, presents a live phishing page or pressures the user.

Different second factors stop different attacks

The useful move is to separate what the claimant controls from evidence you can obtain independently. Names, logos, caller ID, screenshots and a polished page can all be copied. A saved telephone number, a typed official address, a known colleague or a protected transaction route changes the channel instead of merely inspecting the same claim again.

Risk also depends on consequence. Reading a public page is different from granting remote access, sending an identity document or approving an irreversible payment. As the cost of error rises, require stronger verification and prefer a step you can undo.

Warning signals to assess together

These clues become useful when they form a pattern. Treat each one as a prompt to verify, not as a verdict by itself.

• SMS depends on the mobile account and network

  Pair this observation with a separate check: Prefer phishing-resistant methods for critical accounts.

• Approval prompts can be abused through repetition

  Pair this observation with a separate check: Store recovery codes away from the logged-in device.

• Backup methods may be weaker than the primary method

  Pair this observation with a separate check: Remove obsolete phone numbers and backup routes.

Do not use one clue as a verdict: The best method is one you can recover safely. A stronger factor with no viable recovery plan can create a different failure.

Choose a second factor based on the likely threat

Keep the verification route separate from any contact detail or instruction supplied in the questionable message.

• Prefer phishing-resistant methods for critical accounts

  This step tests the related concern: SMS depends on the mobile account and network.

• Store recovery codes away from the logged-in device

  This step tests the related concern: Approval prompts can be abused through repetition.

• Remove obsolete phone numbers and backup routes

  This step tests the related concern: Backup methods may be weaker than the primary method.

A related recovery control appears in the plain-language passkey guide, especially when one account or channel can unlock another.

Decide what to do after verification

If the independent channel confirms the identity and request, ask whether the proposed method still gives you a record and recourse. Legitimate people and organisations should tolerate a proportionate verification step. Resistance, secrecy or a demand to bypass normal controls is new evidence, not an inconvenience to ignore.

If the evidence remains mixed, reduce exposure: do not send original documents when a redacted copy is enough, do not pay a deposit before verifying authority, and do not approve access broader than the task requires. “Not yet” is a valid decision when the missing fact matters.

For a structured settings review, the privacy settings planner can turn broad concerns into a short list of account checks.

What this verification cannot establish

This guide cannot authenticate a specific person, account, website or transaction. Interfaces and attack methods change, and legitimate situations sometimes contain unusual details. For an active loss, account compromise or safety threat, contact the relevant institution or official reporting service through a verified route.