Two-Factor Authentication, also commonly referred to as 2-Step Verification requires an online account holder to present two separate passwords before being allowed to log in to their account.
The first password is the user’s primary account password and the second password is sent via SMS to a separate location as a unique, time-sensitive security token that expires in a pre-defined period of time (e.g., 10 minutes).
With Two-Factor Authentication in place, even if an Internet attacker has stolen a user’s online account, they cannot log in without also having that one-time password which is sent to the mobile user’s phone.
Results in:
- Reduced probability of an Internet attacker gaining access to an account, resulting in fewer security breaches
- Fewer security breaches means lower total costs of disruption
- The additional layer of protection can be advertised to account holders, and having this option available reduces the reputation risk following a security breach