Two-factor authentication is often described as the silver bullet of account security. But like any security measure, it has strengths and limitations. Here's what 2FA actually protects against — and what it doesn't.
In This Guide
Key Takeaways
- ✓ 2FA stops 99%+ of automated attacks and bulk phishing but is not foolproof against targeted attacks
- ✓ Hardware security keys (FIDO2/WebAuthn) are the only 2FA method resistant to real-time phishing
- ✓ SMS 2FA is the weakest form — vulnerable to SIM swapping — but still far better than no 2FA
- ✓ 2FA must be combined with a password manager, device hygiene, and security awareness for real protection
What 2FA Stops
2FA is exceptionally effective against the most common attack types. When security researchers and platforms publish statistics about 2FA effectiveness, they are measuring its impact on these specific attack vectors.
Stolen passwords and credential stuffing: The single most common account takeover vector is credential stuffing — attackers take username and password pairs from data breaches and try them on other services. Since people reuse passwords across sites, a breach at one service cascades to others. 2FA stops this completely. Even if the attacker has your exact password, they cannot log in without the second factor. Google's research showed that 2FA blocks 100% of automated bot attacks, which includes credential stuffing.
Bulk phishing attacks: Phishing emails that trick users into entering their password on a fake login page are the second most common attack. Bulk phishing targets thousands of users indiscriminately. Standard TOTP-based 2FA stops bulk phishing because the fake site collects the password and the TOTP code, but the code expires after 30 seconds. By the time the attacker tries to use the stolen credentials on the real site, the code is invalid. This is why Microsoft reported that enabling MFA prevents 99.9% of account compromise attacks on their platform.
Brute force attacks: Automated password guessing attacks against accounts without rate limiting are rendered useless by 2FA. Even if the attacker successfully guesses the password through brute force, they hit the 2FA wall. Combined with account lockout policies, 2FA makes brute force attacks impractical against any account that has it enabled.
Keyloggers: If your device is infected with a keylogger that records every keystroke, the attacker gets your password. But a keylogger only captures what you type — it does not capture the TOTP code generated on your phone. Since the 2FA code is generated on a separate device (your phone) and entered manually, a keylogger on your computer would need to capture both the password and the code, and the attacker would need to use both within the 30-second window.
What 2FA Doesn't Stop
The honest answer is that 2FA has meaningful blind spots. These are the attacks that 2FA does not protect against, and they are worth understanding.
Real-time phishing (EvilGinx, Modlishka): The most sophisticated phishing toolkits set up a proxy between the victim and the real website. The victim logs in on what looks like the real site, entering their password and 2FA code. The proxy forwards both to the real site in real time, captures the authenticated session cookie, and then logs the victim out. The attacker now has an active session without needing the 2FA code again. This is called an "adversary-in-the-middle" (AiTM) attack. EvilGinx and Modlishka are the most well-known tools that automate this. TOTP codes do not protect against this because the code is relayed in real time. For a deeper analysis, see our does 2FA protect against phishing article.
Session hijacking: After a successful login, the website gives your browser a session cookie that identifies you as authenticated. If an attacker steals this cookie — through malware, network interception, or an XSS vulnerability on the site — they can use it to access your account without needing a password or 2FA code. The session cookie is already authenticated. This is why session expiry settings matter. Short session lifetimes (15-60 minutes of inactivity) limit the window for session hijacking attacks.
Device malware: If your phone is compromised with malware that has screen-reading or accessibility service permissions, it can capture TOTP codes as they are displayed in your authenticator app. Malware on your computer can also capture codes as you type them. 2FA was designed on the assumption that the second-factor device (your phone) is trusted. If that assumption is broken because your phone is compromised, 2FA provides no additional protection.
SIM swapping (against SMS 2FA): SMS-based 2FA is vulnerable to SIM-swap attacks. An attacker contacts your mobile carrier, convinces them to transfer your phone number to a new SIM card, and then receives your SMS codes. This is a well-documented attack that has been used to hijack cryptocurrency exchange accounts and high-value social media profiles. App-based TOTP is not vulnerable to SIM swapping because the codes are generated locally on your device. See our SIM swapping explained guide for details.
Social engineering: Attackers can bypass 2FA by calling a customer support line and convincing the agent to disable 2FA or transfer the account to a new email. This happened in high-profile Twitter hacks where attackers called carriers to SIM swap and then called Twitter support to bypass 2FA. Social engineering attacks target the human element rather than the technical controls. Platform-to-platform verification, extended verification holds, and strict phone support protocols are the only defenses.
Which 2FA Method Is Strongest
Not all 2FA methods offer the same level of protection. Understanding the hierarchy helps you choose the right method for each account.
Hardware security keys (FIDO2/WebAuthn) — strongest: FIDO2 keys are the only 2FA method resistant to real-time phishing. The reason is cryptographic: the key signs a challenge that includes the website's domain name. If you are on "go0gle.com" instead of "google.com", the signature will not match, and the login fails. The attacker cannot relay a FIDO2 authentication because the challenge is bound to the specific origin. This is the gold standard and the only method that NIST considers truly phishing-resistant. YubiKey, Google Titan, and other FIDO2 keys fall into this category. For a direct comparison, see our hardware key vs authenticator app guide.
TOTP authenticator apps — strong: Time-based one-time passwords generated by apps like Google Authenticator, Authy, and Microsoft Authenticator are the best balance of security and convenience. They resist SIM swapping and bulk phishing. Their weakness is real-time phishing proxies, which can relay the TOTP code. Despite this, they are vastly more secure than SMS. For most users, TOTP with a well-chosen authenticator app is the right choice.
Push notifications — moderate: Push-based approval sends a notification to your phone that you tap "Approve" or "Deny." This is more convenient than typing a code, but introduces a new attack vector: push fatigue. Attackers bombard the user with push notifications until they mistakenly approve one out of frustration. Push notification spam has been used in several high-profile account takeovers. It also does not protect against real-time phishing if the user approves the prompt thinking they initiated the login.
SMS / text message — weakest (but still useful): SMS 2FA is vulnerable to SIM swapping and SS7 protocol attacks. However, it remains far better than no 2FA. Google's data shows SMS stops 100% of automated bots, 96% of bulk phishing, and 76% of targeted attacks. If a service only offers SMS, enable it. But if you have a choice, pick TOTP or hardware keys. For a detailed comparison, see our SMS vs authenticator app article.
Common 2FA Bypasses
Attackers have developed several techniques to bypass 2FA entirely, without needing to break the cryptographic algorithm or guess codes.
Recovery code theft: When you enable 2FA on most services, you are given backup codes — 8-10 one-time codes that bypass 2FA. These codes are often stored insecurely: screenshots in the cloud, emails, or sticky notes. If an attacker finds your backup codes, they gain permanent 2FA bypass access. Always store backup codes in a password manager or a physical safe, never in plain text or unencrypted cloud storage.
Backup login methods: Many services offer secondary login methods that do not require 2FA. For example, a service might send a magic link to your email that logs you in without a password or 2FA code. If your email is not protected by 2FA, the attacker compromises your email and then uses password reset or magic links to bypass 2FA on every other account. This is why securing your email with 2FA is the highest priority.
OAuth token abuse: If you logged in to a service using "Sign in with Google" or "Sign in with Apple," the OAuth token may not require 2FA when used by an authorized application. Attackers who gain access to your Google session (through session hijacking or malware) can use that access to authenticate to third-party services linked to your Google account, bypassing any 2FA those third-party services have. Revoking OAuth tokens for applications you no longer use reduces this risk.
Session cookie theft: As mentioned above, stealing a valid session cookie bypasses all authentication. This is the bypass used in the most sophisticated attacks. Tools like the "Cookie-Editor" browser extension and Metasploit's session cookie theft modules make this accessible to less skilled attackers. Using HTTPS everywhere, avoiding public Wi-Fi without a VPN, and using browser security extensions like uBlock Origin reduce session cookie theft risk.
Layered Security Beyond 2FA
Because 2FA has gaps, security professionals use a layered approach — multiple controls that cover each other's weaknesses. Here is what you should add beyond 2FA.
Password managers: A password manager generates and stores strong, unique passwords for every account. This prevents credential stuffing (if every password is unique) and makes phishing attacks less effective (most password managers auto-fill only on the correct domain). 1Password, Bitwarden, and Dashlane all support TOTP code generation directly in the app, combining password management and 2FA into one tool. This means you do not need a separate authenticator app, and the 2FA code auto-fills alongside the password — but only on the correct domain.
Passkeys: Passkeys are the next evolution beyond passwords and 2FA. They use the same FIDO2/WebAuthn technology as hardware security keys but are stored on your device (phone, laptop) rather than a separate physical key. Passkeys are phishing-resistant, cannot be guessed or reused, and are backed up through platform clouds (iCloud Keychain for Apple, Google Password Manager for Android, Windows Hello for Microsoft). Major platforms including Google, Apple, Microsoft, GitHub, and PayPal support passkeys. For a comparison, see our passkeys vs 2FA guide.
Device hygiene: Keep your operating system, browser, and apps updated. Malware that compromises your device defeats 2FA. Regular updates patch the vulnerabilities that malware uses to infect devices. Enable automatic updates on all your devices. Uninstall unused applications and browser extensions. These basic steps prevent the device compromise that is the prerequisite for many 2FA bypass attacks.
Security awareness: The most common 2FA bypass — real-time phishing — depends on the user not noticing they are on a fake website. Training yourself to check URLs before entering credentials prevents phishing entirely. Look for the correct domain name, not just the overall appearance of the page. A phishing site for Google might be "google-secure-login.com" or "g00gle.com" — the visual appearance is identical, but the URL gives it away. Hover over links before clicking, do not download attachments from unknown senders, and never enter credentials on a page you navigated to from an email or text message link.
Bottom Line
2FA stops approximately 99% of automated attacks and the vast majority of bulk phishing. It is the single most effective security improvement you can make for your online accounts. The bypass techniques used against 2FA — real-time phishing proxies, session hijacking, SIM swapping — require significant effort and are typically targeted against high-value individuals rather than random accounts.
For the average person, enabling 2FA with an authenticator app eliminates the most common account takeover risks. For anyone with elevated risk (journalists, executives, crypto holders, public figures), adding hardware security keys and passkeys closes the remaining gaps that TOTP cannot cover.
The bottom line is simple: 2FA is not perfect, but it is the best single step you can take. Combine it with a password manager, keep your devices updated, and stay aware of phishing. That combination protects against essentially all practical attack scenarios.