What is two-factor authentication?
Published
Two-factor authentication (2FA) is a security layer requiring the user to provide two distinct factors to prove identity: something they know (a password) and something they possess (a code from an app, an SMS, a physical key). With it, a leaked password alone cannot open the account.
Why it is the single most important control
Passwords leak - through phishing, reuse across breached sites, or weak choice. 2FA breaks the chain: an attacker who knows the password doesn't possess your device and cannot generate the code. Security-industry data repeat the same finding: enabling 2FA reduces successful account takeovers on affected accounts dramatically.
Types, weakest to strongest
| Type | How it works | Weaknesses |
|---|---|---|
| SMS | A code sent to your phone | Vulnerable to SIM-swap attacks |
| Authenticator app (TOTP) | An app generates a code every 30 seconds (Google Authenticator, Authy) | Much stronger, no network needed |
| Hardware security key (Passkey/FIDO) | A cryptographic key in a physical or built-in device | Strongest, structurally phishing-resistant |
Practical recommendation: start with an authenticator app as the minimum; SMS is better than nothing - but not to be relied on for critical accounts.
Who must be required to use it on your accounting system
Every user, no exceptions - with decisive priority for:
- The owner and finance manager - the highest permissions, a prime attacker target.
- Payment approvers - a compromised account here means real cash transfers.
- E-invoicing access - a compromise can generate fake invoices in your name.
The user who resists enabling it "because it's inconvenient" is often the same one reusing a weak password across multiple sites - a source of risk, not an exception to the rule.
Frequently asked questions
I lost my device - am I locked out?
Which is why recovery codes are generated at enablement - printed or stored in a password vault. In enterprise systems, the admin resets after identity verification.
Does it replace strong passwords?
It strengthens them, doesn't replace them - a two-layer defence beats a single strong one.
An accounting system without 2FA?
A serious question mark on the system. In 2026, its absence on a cloud financial system is an obvious security shortfall.