On this page
A stolen password is no longer enough
With a second step at sign-in, whoever steals your password can do nothing with it. You will also see 2FA, two-step verification and MFA, multi-factor authentication; as long as two proofs are involved, they mean the same thing.
The kinds matter. A password plus a code on your phone is two-factor authentication. Two passwords in a row are not: that is the same kind of proof twice. Safeonweb, the Belgian government's online safety site, gives the shortest advice there is: switch it on wherever you can, and start with your email, because whoever controls your mailbox can reset every other password you have.
How much it helps, Microsoft measured on its own accounts in 2019: a second step can block more than 99.9 percent of attempts to take over an account.
The bank card reader, and now the passkey
Banks have used a second step for a long time: the card reader that turns your bank card and PIN into a one-time code. The open standard for such codes, HOTP, appeared in December 2005 as RFC 4226, co-written by Frank Hoornaert of VASCO Data Security, then based in Wemmel near Brussels. In May 2011 came RFC 6238, TOTP: a code that changes every 30 seconds by default. That is the code Google Authenticator and Microsoft Authenticator show you today.
The next step came on 4 March 2019, when the W3C made Web Authentication a standard. Your device creates a key pair bound to one website; that is the basis of passkeys and security keys. In Belgium you meet itsme almost everywhere: according to its own site, almost 8 million Belgians use it, with the app on their phone and a five-digit secret code. NIST, the US institute that sets the reference rules for digital identity, rewrote its guidance in July 2025 as SP 800-63B-4.
A fake sign-in page, with and without a second step
Password or PIN
What is in your head.
Phone, app or key
What is in your hand.
Finger or face
Unlocks your device.
- Code by SMSThe fake site asks for the code too and passes it on at once.Scammer gets in
- Code in an appSame story: the code lasts 30 seconds, long enough.Scammer gets in
- Approve in an appYou get a prompt you did not start. Approve it and he is in.Depends on you
- Passkey or security keyYour device only answers the real site. The fake one gets nothing.
Any second step beats none. Only a passkey or security key also stops a fake site.
A code by SMS or in an app
- What you need
- Code by text messageA mobile number
- Code in an authenticator appAn app on your phone, such as Google or Microsoft Authenticator
- No signal
- Code by text messageDoes not work
- Code in an authenticator appWorks: the code is calculated on your device
- Weak spot
- Code by text messageWhoever takes over your number gets your codes
- Code in an authenticator appWhoever tricks you out of the code has 30 seconds
- NIST status
- Code by text messageRestricted
- Code in an authenticator appAllowed
- Cost to the user
- Code by text messageNothing
- Code in an authenticator appNothing: the app is free
Given the choice, take the app, or better still a passkey. SMS beats nothing, and that is all.
SMS, app, key, passkey or a national ID app
Not every second step is equally strong. The difference comes down to one question: does the method hold when someone lures you to a fake sign-in page?
| Method | What you need | Holds against a fake site | Cost to the user |
|---|---|---|---|
| Code by SMS | Your mobile number | No: you type the code into the fake site too | Nothing |
| Code in an app | A free app such as Google Authenticator | No: the scammer has 30 seconds to use it | Nothing |
| Approve in an app, such as itsme | The app plus a secret code | Partly: only if you approve nothing you did not start | Nothing |
| Passkey | Your phone or computer, unlocked by fingerprint, face or PIN | Yes: the key belongs to the real site | Nothing |
| Security key | A key over USB or NFC | Yes, for the same reason | 35.09 to 70.18 euros per key at Yubico |
NIST's 2025 rules are blunt. SMS and voice are a restricted method. A code by email may not serve as the second step. Any service that offers two-factor authentication has to give users at least one phishing-resistant option, and at the strictest level that option is required. NIST also treats the password differently: as the only step it must be at least 15 characters long, with a second step at least 8.
An accounting firm with and without a second step
Say a tax advisory firm in Düsseldorf with eight staff runs a client portal where 200 clients upload invoices and payroll files. One employee clicks a fake email that looks like a portal notification and types in their password. Without a second step, the scammer is inside the files of 200 companies. With an app code, he also needs to trick the employee out of that code within 30 seconds. With a passkey he gets nowhere: the fake site receives no usable answer from the device.
What the firm pays: nothing for the apps. If it chooses security keys, that is two per person, one in use and one spare, at 35.09 euros including Belgian VAT: 561.44 euros for eight people. Setting it up takes about a quarter of an hour per person. Whoever builds the portal pays no licence for TOTP or passkeys; they are open standards. Using itsme inside your own portal does require a contract with itsme, and it mostly makes sense if your users are in Belgium.
A second step in your own portal
For tools you rent, two-factor authentication is a setting: in your email, your accounting package, every SaaS tool and the admin account of your website. That last one is often forgotten; why it matters is explained in is WordPress safe?.
If you build your own software, such as a client portal, an app or a web application, the sign-in page always sits behind https with a valid SSL certificate, and you make four choices. Who has to use it: required for staff and admins, offered to clients. Which methods: an app and passkeys, SMS at most as a fallback. How someone who lost their phone gets back in, without a scammer being able to do the same with one phone call. And whether you can revoke sessions, so a stolen laptop is locked out at once. If your company falls under NIS2, check what the Belgian deadline of April 2027 means for you. If a software supplier handles your client data, set the terms in a data processing agreement. And if you sell software yourself, read what the Cyber Resilience Act asks in reporting.
Short answers about signing in
What is a 2FA code?
The second step after your password: usually six digits from an app or a text message, valid for a short time. In an app the code changes every 30 seconds by default. Only type it on a site you went to yourself.
Can two-factor authentication be hacked?
Yes, if you are tricked into helping. A scammer can get a code out of you through a fake site or a phone call, or move your mobile number to his own SIM to receive your texts. Passkeys and security keys only work on the real site and stop that.
What if I lose my phone?
You use a recovery code, a second key or a second device you set up in advance. Without any of those you have to prove who you are to the service itself, which takes time. Always set up a fallback.
Is two-factor authentication free?
For you, almost always. Authenticator apps cost nothing, text codes are free to receive, and passkeys live in your phone or computer. Only a physical key costs money: from 35.09 euros at Yubico.