Two-factor authentication is worth having in every form. But treating the three common forms as interchangeable produces a specific and expensive false confidence, because one class of attack passes straight through two of them.
Three methods, three different things that break
| Method | What it depends on | How it fails |
|---|---|---|
| SMS code | Your phone number | The number is moved to someone else through the carrier, or messages are read at device or network level |
| Authenticator app | A secret stored on your device | Device loss or compromise; the code is relayed through a phishing page in real time |
| Hardware security key | A physical device bound to the site's domain | Losing the key with no spare registered |
SMS is weakest because it rests on something you do not control. A phone number is administered by a carrier, and carrier processes exist to move a number to a new device. That path does not touch your password at all.
An authenticator app removes the carrier from the picture, which is a genuine step up. The secret lives on your device and the codes are generated locally.
A hardware key adds one property the other two lack: it knows which site it is talking to. That single property is what the next section is about.
The relay problem, and why it matters more than it sounds
"I have 2FA on, so a fake site can't get in" is wrong
Consider what happens on a convincing impostor page. You enter your password; it is forwarded to the real site immediately. The real site asks for a code; the impostor page asks you for a code. You read it off your authenticator app and type it in. It is forwarded within seconds, while still valid.
Nothing was broken. The code worked exactly as designed — it was simply used somewhere you did not intend. SMS and authenticator apps are both vulnerable to this, because neither knows which site is asking.
A hardware key does not have this weakness, because the response it produces is tied to the origin requesting it. Presented with a lookalike domain, it produces something the real site will not accept, not because it detected fraud, but because it is answering a different question. The public specification behind this behaviour is W3C WebAuthn, and the FIDO2 documentation covers the wider standard.
This is the practical conclusion: if you are relying on 2FA to protect you from ending up on a fake site, only the hardware option actually does that. The other two protect against a stolen password, which is a real and different threat.
Backup codes are a second key, not a formality
Backup codes bypass two-factor completely. Anyone holding them does not need your phone, your app or your key.
So they deserve the same handling as a seed phrase: written on paper, stored separately from your devices, and never screenshotted, saved in notes, or messaged to yourself. The failure mode here mirrors the one in why a seed phrase must never be photographed — the leak happens through actions that feel like reasonable record-keeping.
Store them somewhere you will actually find them. Backup codes filed so carefully that you cannot locate them under pressure have the same effect as not having them.
The step people miss before changing phone
Order matters, and reversing it locks you out
While the old phone still works: migrate two-factor for every account to the new device, or confirm your backup codes work. Only then wipe the old one.
Wiping first is the single most common way people lock themselves out of their own accounts, and recovering from it means going through account recovery on every service at once, precisely when you have no working second factor.
Two related habits. Keep a short list of which accounts have two-factor enabled — most people underestimate the number. And when a service offers to let you register a second method, take it; redundancy at setup costs a minute and saves the whole recovery process.
What to actually pick
Move off SMS where the option exists. Use an authenticator app as the baseline. Add a hardware key if you hold balances you would mind losing.
That ordering holds regardless of platform, though not every service supports all three — availability is whatever the platform's security settings currently show. If SMS is the only option offered, it is still much better than nothing; the point is not to refuse it, but to know what it does and does not cover.
One thing worth doing whichever method you choose: set it up before you deposit anything. The cost on an empty account is a few minutes, and the walkthrough with the rest of the account setup is in the sign-up guide. If you also want to constrain where funds can go, the trade-offs of a withdrawal whitelist are in is a withdrawal whitelist worth turning on.
Common questions
I turned on two-factor. Am I safe now?
It depends entirely on which one you turned on. Neither SMS nor an authenticator app stops a real-time phishing relay — the code you type into an impostor page is forwarded to the real site within seconds. Only a domain-bound hardware security key refuses to respond to the wrong site.
Why is SMS considered the weakest option?
Because it depends on your phone number, and a number can be moved to someone else through carrier processes. Message content can also be exposed at the device or network layer. Neither of those requires knowing your password.
How should backup codes be stored?
Written on paper, stored separately. Not screenshotted, not in a notes app, not messaged to yourself. Backup codes bypass two-factor entirely, so they deserve the same handling standard as a seed phrase.
What should I do before changing phone?
While the old phone still works, migrate every account's two-factor to the new device or confirm your backup codes are usable — then wipe the old one. Wiping first and migrating second is the most common way people lock themselves out.
What happens if I lose my hardware key?
This is why you register a second key as a spare when you set the first one up, and keep the backup codes. Registering a single key with no fallback is the biggest practical risk of the hardware approach — larger than the attacks it prevents.