Short answer
The short answer
MFA, multi-factor authentication, is signing in with two or more different kinds of proof. 2FA is MFA with exactly two. 2SV, two-step verification, is two steps one after the other, and its two steps can be the same kind of proof, so it is not always 2FA.
A code from an authenticator app and a code sent by text message are both codes you type in, and neither is phishing-resistant. Passkeys and hardware security keys are the main phishing-resistant options.
More guides: what two-factor authentication is, and passkeys vs authenticator codes.
The terms
What the three terms mean
- MFA. The Canadian Centre for Cyber Security says: “With MFA enabled, two or more different authentication factors are needed to unlock a device or sign in to an account.” NIST defines it as “An authentication system that requires more than one distinct type of authentication factor for successful authentication.”
- 2FA. The Cyber Centre says: “Two-factor authentication (2FA) is a type of MFA and is validated by using a combination of two different authentication factors to access a device or system.” So 2FA is the case of MFA with exactly two.
- 2SV. The Cyber Centre says: “Two-step verification is a process requiring two authentication methods, which are applied one after the other.” It adds that, unlike 2FA, “two-step verification can be of the same factor type”. Two passwords, one after the other, are two-step verification and are not two-factor authentication.
Some services use “2-step verification” as the name of their own sign-in feature: Google, TikTok and OLG do, as our guides for Google, TikTok and OLG say. Which kinds of proof a service’s feature asks for is something its own help page says, and this page can’t say it for you.
Proof
The three kinds of proof
The Cyber Centre lists the kinds, which it calls factors:
- Something you know. “Typically, your passphrase, password (PIN).” NIST puts it the same way: “A password is ‘something you know.’”
- Something you have. “This factor can include a hard token (such as a USB key or access card) or a soft token (such as an authenticator app or SMS message).”
- Something you are. “This factor relies on a unique biometric characteristic (such as fingerprints, retina, or facial structure).”
A password and a code from an app are two different kinds, so that is two-factor authentication. A password and a PIN are the same kind. An app code and a text-message code are also the same kind, because both are something you have.
App or text
An app code or a text message
Both are codes, and both count as something you have. They differ in how the code reaches you. A text message crosses the phone network. An authenticator app works the code out on your device.
NIST names one restricted authenticator: using the phone network, by text message or voice call, to deliver a code. It says restricted authenticators “represent a less secure approach to multi-factor authentication”, and that a service should consider “device swap, SIM change, number porting” before sending a code that way. An app code does not travel over the phone network, so those risks do not apply to how the code reaches you. Our guide on why a code in an app beats a code by text message goes through the difference.
Fake websites
What a typed code can’t do
NIST says: “Authenticators that involve the manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant because the manual entry does not bind the authenticator output to the specific session being authenticated.” That covers a code sent by text and a code from an authenticator app alike: a fake website can pass on what you type to the real one.
NIST also says: “Phishing resistance requires single- or multi-factor cryptographic authentication.” Passkeys and hardware security keys sign in that way, with a cryptographic key and no code to type, and the Cyber Centre gives FIDO-based solutions as its example of phishing-resistant MFA. Our guide on passkeys vs authenticator codes explains them.
Where a service offers neither, a code from an app is still worth having. Type it into a site you opened yourself and nowhere else, and never read it out: see why you should never share your 6-digit code.
Guides
Where to turn it on
Each guide shows where one service puts the setting. They are listed on the Notes page too, and our guide on which apps and websites work with an authenticator app links to many more.
Our turn
An example from our app
MELKEM Authenticator makes its codes on your iPhone. It is an authenticator app, so what NIST says about a typed code applies to its codes too: they are not phishing-resistant.
