What is 2FA?
Two-factor authentication (2FA) is a security process where a user must provide two authentication factors to prove that they are who they say they are.
You don’t always realize it, but every time you complete simple actions like entering your PIN when using your debit card or providing ID at the bank, you’re using two-factor authentication. It is an easy way for your customers to access their information and ensure they are not compromising any data.
In this article, we’ll take you through everything you need to know about 2FA so it can become an integral part of your business security processes that protect your customers.
What are authentication factors?
Authentication factors are pieces of information you need to gain access to an account. The first authentication factor required is simple – your username and password. But before you can complete your login, 2FA requires a second factor to validate your identity.
There are three main types of authentication factors:
- What you know: a password, a PIN, or an answer to a security question.
- What you have: a phone, credit card, or fob.
- What you are: a biometric such as a fingerprint, retina, face, or voice.
They can be mixed and matched to be used in whichever way suits your company’s purpose.
What passwords are not good enough
It’s no secret that remembering multiple passwords is frustrating. According to Verizon, in 2021, 81% of data breaches were due to poor password security. People like to use simple passwords and reuse them on multiple accounts. In fact, 76% of millennials admit to reusing their passwords. This makes it easier for hackers to guess and access your data and information and increases the need for 2FA.
Here are some common mistakes people make when creating a password:
- Using any personal information
- Changing only one digit or character in an old password
- Reusing old passwords
- Replacing a letter with a similar looking number (ex. ‘@’ for ‘a’)
- Using one word instead of a random phrase or sentence
- Using only 8 characters
Why is 2FA important?
Your customers’ security should be one of your highest priorities. If they experience a security breach it could be completely life-changing for them.
According to Verizon, 80% of cyber breaches could be prevented by 2FA. This could be something as simple as a transaction requiring an SMS confirmation. It is less likely that someone will be able to get a hold of your password and your phone.
Recently Google also reported that 100% of automated bots, 99% of phishing attacks, and 66% of targeted attacks were blocked by two-factor authentication.
2FA provides an extra layer of security and makes it harder for attackers to access their accounts. Simply adding a layer of 2FA to logins and transaction processes can alleviate risk.
Nowadays it’s also important to make sure you are PSD2 compliant – this regulation directly impacts banks, fintechs, and businesses using payments data.
It aims to better align payment regulations with the current state of the market and technology. It’s also encouraging companies to exchange customer data more securely with third parties, which can only be a good thing.
Types of 2FA
There are many options as to how you can send your customers their PIN. The customer receives a PIN over a particular channel and uses that PIN to login. You can also send time-based one time PINs (TOTPs) where the PIN will expire after a certain amount of time. TOTP offers a better layer of protection as the time limit reduces the chances of hackers bypassing two layers of protection.
You can use 2FA on more than one channel- making it easy to adapt to your business’ current communication strategy. Common 2FA channels include:
- In-app push notifications
- Chat apps
Additional Components of 2FA
Other components of 2FA security include number look up and process tracking.
Number lookup is a great way to reduce costs and ensure a customer receives their PIN. By checking the status of a person’s phone number, you can ensure your customers receive their PIN on the channel that best suits them.
For OTT businesses, if a customer enters the wrong phone number, they can never get the SMS with the PIN number necessary to complete the installation. They could lose an excellent way to stay in touch with their friends, while the app makers lose a potential user. Having in mind the intense competition in the messaging space, this is likely to be the last thing app makers want.
By offering detailed insight into mobile networks to check numbers for validity, number lookup is extremely beneficial to OTT providers. It can provide insight on if a number is nonexistent, unused or landline phone and offers customers the chance to re-enter their phone number if it is incorrect.
Process tracking can measure how many PINS are sent versus how many are used. Measuring this conversion rate allows you to understand how your customers are using your 2FA service and how convenient it is for them. This additional insight can help you optimize your 2FA service, making it easier to use.
How does 2FA work?
The most common use of 2FA is when a customer logs in using a password and then is sent a one-time pin (OTP) code to confirm their identity.
They can then be presented with how they would like to confirm their identity.
Then, a verification code will be sent via the customer’s chosen method.
The second factor in the authentication adds an extra layer of security (for example, a hacker would need to know your password AND have access to your phone in order to get into your account).
The second factor works by releasing an OTP to be used, which can’t be replicated once it’s been used.
A verification notification will then be received, and the identity can be confirmed.
To read more on the technology behind two-factor authentication, see our 2FA process overview here.
What are the benefits of 2FA
1. Seamless Authentication
The goal of 2FA is to secure personal information while still providing a smooth user experience. Through push notifications, there’s no need to enter a PIN to confirm the authentication, a simple click is all that’s required.
An omnichannel 2FA is created by allowing customers to choose the method that best suits them, putting UX and security first.
2. Stronger security
It’s not easy for a hacker to bypass 2FA, making it an effective security tool against fraud. Potential threats would have to know lots of information to gain access and duplicate information, not just one password.
Turning on two-factor authentication is an easy way to stay protected. Even the simplest form of 2FA puts a practically impenetrable wall between hackers and your customers’ personal information.
Taking these steps to protect your customers’ accounts will offer them the highest level of security and the best UX, creating happy and secure customers all around.
3. Increased productivity and flexibility
Companies that embrace new technology are likely to experience better productivity and flexibility. Customers can sign up for services faster and more securely than before.
In businesses, 2FA is used so employees can securely access corporate applications, data, documents, and back-office systems from virtually any location without putting company data at risk.
4. Lower security management costs
Implementing 2FA can help reduce the lengthy and costly password reset calls and can act as a secure way for customers to sort these issues out themselves.
Reducing customer interactions with call centers, not only strengthens security but also improves UX. Then, as a massive bonus, operational overheads that are associated with security controls are reduced.
5. Drives customer confidence
Having stronger security measures for ecommerce sites increase consumers’ trust. Consumers are more likely to trust other consumers on sites like eBay or PayPal knowing that everyone on the system must pass through the same tight security as they did. Building a large circle of trust within the community—especially with services like eBay and Etsy—is essential to these services’ long-term success.
Industries that use 2FA
It is common, and crucial for banks to use 2FA services. From requiring a PIN to access your bank card, to a TOTP to finalize money transfers, 2FA keeps the banking information of customers safe and secure.
Online retailers often use 2FA during the login process. When credit card information can be saved and stored on their accounts, it is essential to add an extra layer of protection for their customers to feel safe buying from their sites.
Healthcare organizations are responsible for securing patient data and information. By using 2FA, they can reassure their patients that only they have access to their medical records. 2FA is also required for doctors to access patient files.
Governments have had to make a shift to using online and cloud-based platforms for people to access their government accounts. This can include anything from student loan accounts, retirement savings, applications for driver licenses and other government services. Using 2FA offers the safest and most user-friendly experience. People can now securely access many government documents and records online with little to no hassle. This makes using government sites easier than ever.
Protect your business and customers with 2FA
As cyber security is an essential part of putting customers first, 2FA offers a safe and easy to use solution that benefits both businesses and consumers. Strong authentication and security are a must-have for business-critical services.
When consumers see companies offering 2FA for enhanced security, it serves as a proxy for dedication to overall security. Consumers know that security breaches are unpredictable—and sometimes they are out of a company’s control—but companies that implement 2FA signal to consumers that they take security seriously. This is increasingly important as we trust more of our digital lives to online services.This post was last modified on May 25, 2022 and originally published on July 2, 2019.