What is two-factor authentication (2FA) and how to use it
A second lock on top of your password. See how two-factor authentication works, why SMS is the weakest option and how to use an authenticator app.
Two-factor authentication, also called 2FA or two-step verification, is a second lock on your account, on top of your password. Even if someone finds out your password, they'll still need a code that only your phone generates. In this guide, you'll learn how it works, why it matters so much on accounts that move money and how to use an authenticator app, step by step.
What two-factor authentication is
To log in to an account or take an important action, you prove who you are in two different ways:
- something you know: your password;
- something you have: your phone, which generates or receives a code.
It's like a door with two locks. Whoever steals one of the keys is still left outside.
Why protect your account with 2FA
Passwords leak. They show up in data breaches from other websites, get stolen by fake pages and are often reused by people across several services.
On an account that moves money, such as a crypto account, a stolen password can turn into a loss within minutes. And since crypto transfers can't be undone, there's no fixing it afterward. Two-factor authentication is what separates "the scammer knows my password" from "the scammer took my money".
Learn about the tricks most often used to steal passwords in USDT and Pix scams.
Types of two-factor authentication
Code by SMS
The service sends a code by text message. It's better than nothing, but it's the weakest option. In a SIM swap scam, the criminal manages to move your phone number to another SIM card and starts receiving your text messages.
Code by email
It works well as an extra confirmation, but it depends on your email being well protected. If someone breaks into your email, they break through this lock too.
Authenticator app
An app on your phone generates a 6-digit code that changes every 30 seconds. The code is created on the device itself, so it works even without internet access, and it can't be intercepted like a text message. It's the recommended option for most people.
Security keys and passkeys
Some services accept physical security keys or passkeys, stored on your phone or computer. They're very secure options, but they aren't available everywhere yet.
How to use an authenticator app, step by step
1. Install an authenticator app
Search for "authenticator" in your phone's official app store (Google Play or the App Store). There are several free, well-known options, such as Google Authenticator and Microsoft Authenticator. Only download from the official store and check the developer's name.
2. Turn on two-factor authentication in the service
Log in to your account, go to Security or Profile and look for the two-factor authentication option. The service will show a QR code and a setup key, a code made of letters and numbers.
3. Scan the QR code with the app
In the authenticator app, tap add account and scan the QR code. If you're using the same phone and can't scan the screen, choose to type in the setup key. If the app asks for the type, choose time-based.
4. Enter the 6-digit code
The app now shows a code that changes every 30 seconds. Type the code currently on screen into the service. Done: two-factor authentication is on.
5. Keep a way to recover access
If the service offers recovery codes, write them down and keep them somewhere safe, away from your phone. Some authenticator apps also let you back up or transfer your accounts to another device. It's worth setting that up right at the start.
Common problems with two-factor authentication
The code doesn't work. The code depends on your phone's clock. If the time is wrong, the code comes out wrong. Set the date and time to automatic. Also check that you're typing the current code, not one that has already expired.
I'm switching phones. Move your authenticator app to the new device before you wipe or sell the old one. Many apps have an option to transfer or export your accounts.
I lost my phone. Use your recovery codes, if you have them. If you don't, contact the service's official support. Recovery usually requires confirming your identity, which is a hassle, but it's exactly what stops a scammer from doing the same.
Never share your code with anyone
This rule has no exceptions. Your two-factor authentication code is yours alone. No serious company asks for it by phone, WhatsApp, email or social media.
If someone asks for your code, even claiming to be from "support", "the bank" or "security", it's a scam. Hang up and find the official channel through the website or the app.
The same goes for your crypto wallet's recovery phrase: it should never be given to anyone. See why in crypto wallets: how to choose and protect one.
Two-factor authentication on usdtap
On usdtap, two-factor authentication uses an authenticator app, with a 6-digit code. It's required to confirm a new wallet: on top of the code sent by email, you enter the code from the app. Only then does the wallet become active for transfers.
This lock exists to stop someone who finds out your password from adding their own wallet and sending your money there. And it's worth repeating: usdtap never asks for your password or codes by phone, WhatsApp or email. If you lose your phone, write to [email protected].
Want to understand the rest of the path? See how to send USDT to your wallet without mistakes or create your usdtap account.
Frequently asked questions
What is 2FA?
It stands for two-factor authentication, also called two-step verification. On top of your password, you confirm who you are with a second item, usually a code generated on or sent to your phone.
Is two-factor authentication by SMS safe?
It's better than having none, but it's the weakest option. In a SIM swap scam, the criminal moves your number to another SIM card and receives your text messages. Whenever you can, choose an authenticator app instead.
I changed phones. What happens to my authenticator?
Ideally, transfer the accounts in your authenticator app to the new phone before you wipe the old one. If you no longer have the old phone, use your recovery codes or contact each service's official support.
Why doesn't my authenticator code work?
The most common reason is that your phone's clock is off. Set the date and time to automatic and type the code currently on screen, since it changes every 30 seconds.
Someone asked for my verification code. Can I give it to them?
No. No serious company asks for this code by phone, message or email. Whoever asks is trying to get into your account. End the contact and find the service's official channel.