Two-factor authentication for crypto accounts

Two-factor authentication means that a password alone cannot open an account. After the password, the service asks for a second proof, usually something you hold, such as a phone or a small hardware key. This matters more for crypto than for most accounts, because a transfer out of an exchange login is hard to undo once it is confirmed. A stolen password then becomes much less useful, since the thief still lacks the second item. The second factor comes in three common forms: a code sent by text message, a code produced by an authenticator app, and a physical security key that you plug in or tap against the device. They protect to different degrees, and the differences are worth knowing before choosing one.

Each form works in a slightly different way. A text-message code travels over the phone network to your number, so anyone who takes over that number can receive it. An authenticator app creates a short code on the phone itself every half minute or so, using a secret stored during setup, and no message is sent. A security key answers a login challenge directly and only for the genuine site, which makes it hard to trick. Ethereum.org notes that text codes are open to SIM swapping, where a criminal persuades a carrier to move your number to another card, and recommends an authenticator app or a key instead. Many services let you register more than one method, which gives you a spare if the first one fails.

Imagine a woman named Lena who protects an exchange account with a password and text codes. One afternoon her phone loses signal for no clear reason, and soon after, a stranger tries to reset her password. The codes now go to the stranger. Lena later moves the account to an authenticator app, prints the backup codes that the service offers, and stores them in a drawer at home. Months later her phone falls into a lake. She installs the app on a new phone, uses one backup code to prove who she is, and sets up a fresh secret. The account stays hers because the offline codes still worked when the phone did not.

Most lockouts and break-ins follow a few patterns. The first is relying on the phone number, because carriers can be fooled and numbers change hands. The second is saving backup codes in the same phone, or in an email inbox, so that one loss takes away both the app and its rescue. The third is a weak email account. Email is the usual route for resetting every other login, so a thief who controls the inbox can often reset the rest. The fourth is a social trick: a caller who claims to be support asks you to read out the code that just arrived. No genuine support worker needs that code, and a login prompt you did not start should be refused.

A few checks can be done alone, with the service's own settings page. Does the account offer an authenticator app or a security key, and is the text-message option switched off once a stronger one is active? Are the backup codes stored on paper or on an offline device, away from the phone that runs the app? Is the email account behind the exchange protected with the strongest method it offers? Is there a list of devices and sessions that you can review and close? When you open the page, do you type the address yourself or follow a saved bookmark, rather than a link in a message? Each answer is visible in the settings without contacting anyone.

For the technical reference behind these ideas, a national standards institute published the final revision of its digital identity and authentication guidelines in July 2025, according to that institute, and many online services follow it. Ethereum.org keeps a plain-language security page that covers scams and account protection, and consumer protection agencies explain how scammers ask for one-time codes. None of these pages can judge how a particular service is built or what suits your own circumstances. This article is general education, not security or financial advice, and each service's own help pages remain the final word on its login options.

• An authenticator app or a security key resists SIM swapping better than a text-message code
• Keep backup codes on paper or offline, never in the same phone that runs the app
• Protect the email account first, because it can reset every other login