[Glossary](https://pecuvo.eu/en/glossary/) · Fraud and security # Two-factor authentication **In short:** two-factor authentication is a login in which, besides your password, you prove it's you with something else — a code in an app, a physical key or a fingerprint — so a stolen password alone is not enough. **Simply put:** There are three kinds of proof: something you know (password, PIN), something you have (phone, key) and something you are (fingerprint, face). Two different kinds make a double lock. Automated programs try millions of leaked passwords — the danger is not how important you are, but a reused password without a second factor. **Example:** Someone steals your email password from a leaked database. Without the code from the app on your phone, they can't get in. **Watch out:** a text-message code is tied to your number, not your phone — the number can be moved. ENISA advises: if you have the choice, use a passkey, a physical key or an authenticator app. **What to do:** turn on a second factor at least for your email and bank. Keep backup codes on paper. Never share a code — not even with a "bank employee". **Source:** ENISA — Cyber Hygiene: https://www.enisa.europa.eu/topics/cyber-hygiene ## In depth in the modules - [Module 28](https://pecuvo.eu/en/modules/digital-finance-and-security/) - [Module 21](https://pecuvo.eu/en/modules/payments-and-purchases/) ## Related terms - [Strong customer authentication (SCA, 3D Secure)](https://pecuvo.eu/en/glossary/strong-customer-authentication/) - [Password and password manager](https://pecuvo.eu/en/glossary/password-manager/) - [Phishing](https://pecuvo.eu/en/glossary/phishing/) - [SMS scam (smishing)](https://pecuvo.eu/en/glossary/smishing/) - [Identity theft](https://pecuvo.eu/en/glossary/identity-theft/)