2FA (two-factor authentication)
2FA is a second lock on your account: besides the password you need a code from an app, a hardware key or an SMS. If your password leaks, nobody gets in without the second factor.
How it works
A factor is a way to prove you are you. A password is something you know. The second factor is something you have: a phone with an authenticator app or a hardware key. Logging in needs both, so a stolen username and password are not enough.
An authenticator app makes a six-digit code that changes every 30 seconds. A hardware key is a small USB or NFC device: it cannot be copied remotely and it will not work on a fake site. SMS is the weakest option, because your number can be moved to another SIM card.
Turn on 2FA on your exchange, your email and everywhere money or access to it lives. Email matters most, since it is used to reset every other password. It takes five minutes and blocks most simple takeovers.
You enabled 2FA with an authenticator app. A scammer found your password in a leaked database but has no code, so the login is blocked. Save the backup codes during setup: if you lose your phone, they bring access back.
Your exchange account has SMS-only 2FA. An attacker talks the carrier into issuing a new SIM with your number, receives the code and withdraws your funds. With an app or a hardware key that trick would fail.
The big mistake is thinking 2FA stops everything. If you type the code into a phishing site or read it to "support", the scammer logs in with your own code. Never share one-time codes, check the site address, do not keep SMS as the only option, and store backup codes offline, not in notes or screenshots on the same phone.
Questions and answers
What is 2FA in simple terms?
It is a second step after your password when you log in. Usually it is a six-digit code from a phone app that changes every 30 seconds.
Is SMS 2FA or an authenticator app better?
An authenticator app or a hardware key is safer. SMS can be intercepted through a SIM swap, so use it only when nothing else is offered.
What if I lose the phone with my 2FA app?
Use the backup codes you saved during setup. Without them you have to go through the service's account recovery, which can take days.
Related terms
Read next
Step by step, from picking an exchange to coins sitting in your own wallet. No leverage, no shortcuts, and a check at every step.
Read →How to secure your crypto exchange account: 2FA, anti-phishing code, whitelistSix settings that close the most common ways exchange accounts get taken over. It takes about half an hour.
Read →Address poisoningAddress poisoning is a scam where someone sends you a tiny transfer from an address that looks like one you often use,…
Updated: 2026-10-19