top of page

Two-Factor Authentication: The Second Lock on Your Digital Door

A Report by CYS Global Remit Network Admin Support Team


A password alone is no longer enough to protect your most important accounts. Two-factor authentication adds a second layer of verification and it takes less than five minutes to set up. Here's how it works.


Why Passwords Are Not Enough

Even a strong, unique password can be stolen through a data breach, a phishing email, or malware on a compromised device. Once an attacker has your password, they have everything they need to access your account. Unless you have two-factor authentication (2FA) enabled.


2FA requires that in addition to your password, you provide a second form of verification to confirm it is really you logging in. Even if someone steals your password, they cannot access your account without also possessing your second factor. It is one of the most effective, accessible security measures available.


The Cyber Security Agency of Singapore (CSA) consistently recommends enabling 2FA across all accounts that offer it, particularly email, banking, social media, and work platforms.


The Three Main Types of 2FA

  • SMS Verification (OTP)

The most common form of 2FA sends a one-time passcode (OTP) to your registered mobile number. You enter this code alongside your password to complete login. SMS- based 2FA is widely supported and easy to use. However, it is considered the weakest form of 2FA — SIM-swapping attacks, where a criminal convinces a mobile carrier to transfer your number to their SIM card, can intercept these codes.

 

SMS 2FA is still significantly better than no 2FA at all, and for most everyday accounts it provides meaningful protection. But for high-value accounts such as banking or primary email, consider stronger options.

 

  • Authenticator Apps

Authenticator apps such as Google Authenticator, Microsoft Authenticator, or the built-in options in iOS and macOS generate time-based one-time passwords (TOTP) — six-digit codes that change every 30 seconds. These codes are generated entirely on your device and are not transmitted via SMS, making them immune to SIM-swapping.

Setting up an authenticator app involves scanning a QR code when you enable 2FA on a supported account. The codes work even without mobile data or an internet connection, making them more reliable in low-connectivity environments.

 

  • Hardware Security Keys

A hardware security key is a physical device — typically a small USB or NFC key — that you insert or tap to your phone or computer to authenticate. Keys such as the YubiKey implement the FIDO2/WebAuthn standard and provide the strongest form of 2FA available. They are immune to phishing because the authentication is bound to the specific website you are visiting.


Hardware keys are recommended for individuals with elevated security requirements — executives, IT administrators, journalists, or anyone with access to particularly sensitive data or systems. For most everyday users, an authenticator app provides an excellent balance of security and convenience.


How to Enable 2FA on Common Accounts

  • Google/Gmail: Account Settings → Security → 2-Step Verification

  • Apple ID: Settings (on iPhone) → [Your Name] → Password & Security → Two-Factor Authentication

  • Microsoft accounts: account.microsoft.com → Security → Advanced Security Options

  • Facebook/Instagram/LinkedIn: Security and Login / Sign-in settings in each app

  • Banking apps: Check your bank's app or website — most Singapore banks now offer OTP via authenticator app


What About Backup Codes?

When you enable 2FA on most accounts, you will be given a set of one-time backup codes. Store these somewhere secure — printed and kept in a safe place, or in a secure note in your password manager. If you lose access to your second factor (e.g., a new phone), these codes allow you to recover your account. Without them, account recovery can be a lengthy process.


Sources

Two-factor authentication for Apple Account https://support.apple.com/en-sg/102660

bottom of page