Two-factor authentication (2FA) requires a second piece of proof beyond your password before letting you into an account — typically something you have, like your phone, in addition to something you know, like a password. It's one of the single most effective things you can do to protect an account, but the specific method you use matters more than most people realize.
The common types, from weakest to strongest
- SMS codes. Convenient and widely supported, but vulnerable to SIM-swapping, where an attacker convinces your carrier to transfer your number to a device they control — after which every SMS code is sent straight to them.
- Authenticator apps. Generate time-based codes locally on your device without relying on your phone carrier at all, closing off the SIM-swap risk entirely.
- Push notifications. A prompt sent to a trusted device that you approve with a tap — convenient, though vulnerable to "prompt bombing," where an attacker spams approval requests hoping you'll tap accept out of habit or fatigue.
- Hardware security keys. A physical device you plug in or tap, generally regarded as the strongest widely available option since it can't be phished or intercepted remotely.
Why SMS still isn't nothing
To be clear, SMS-based 2FA is still far better than no second factor at all — it stops the overwhelming majority of automated, low-effort attacks. The concern is specifically with targeted attacks against accounts worth the extra effort of a SIM swap, like banking or primary email.
A practical approach
Use an authenticator app or hardware key for anything high-value: your primary email, banking, and any account that could be used to reset access to other accounts. SMS is a reasonable fallback for lower-stakes accounts where convenience matters more. Either way, enabling any form of 2FA is a bigger security improvement than almost anything else you can do in five minutes.
Where temporary email fits in
2FA protects an account you're keeping. For accounts you're not keeping — a one-time sign-up you'll never return to — the better move is often to avoid creating a persistent account at all, using a temporary address so there's no long-term login to secure in the first place.