A password is a single piece of proof: something you know. The trouble is, anything you know can also become known to someone else — guessed, leaked in an unrelated data breach, or handed over through a convincing phishing email. Two-factor authentication (2FA) doesn't try to make that one piece of proof unbreakable. Instead, it insists on a second, completely different kind of proof as well — and that combination is what actually stops most account takeovers.
GCSE coreThe three official categories of proof
Security systems classify authentication proof into three factors: something you know (a password, a PIN), something you have (a phone that can receive a code, a physical security key), and something you are (a fingerprint or face scan). Genuine multi-factor authentication combines proof from at least two different categories — which is exactly why a password plus a security question isn't real 2FA: both are still just things you know, and both can be stolen or guessed the same way.
A password alone is one factor — something you know, and things you know can leak. 2FA adds a second, different kind of proof, and requires both together.
Why combining two factors is so much stronger
An attacker who steals a leaked password database now has millions of valid "somethings you know" — but almost none of the matching "somethings you have." Getting past 2FA means compromising two completely different systems at once: your password, and separately, your physical phone or security key. That second requirement doesn't need to be unbreakable on its own — it just needs to be a genuinely different kind of barrier, so a single leak or a single guess can't get through both at the same time.
Exam-style question
A website requires users to enter a password and then answer a security question (for example, 'What is your mother's maiden name?'). Explain why this is not genuine two-factor authentication. [3 marks]
Show model answer and mark breakdown
- Genuine 2FA requires proof from two different categories: something you know, something you have, and something you are (1 mark)
- Both a password and a security-question answer are things the user knows (1 mark)
- Since both factors come from the same category, an attacker who obtains one (for example, through research or a data breach) can often obtain the other the same way, so there's no genuinely independent second barrier (1 mark)
Examiner focus: name the three factor categories and identify that both examples fall into the same one — that's the entire reasoning being tested.
Common mistake: assuming any second piece of information automatically counts as 'two-factor' — the requirement is two different types of proof, not just two pieces of information.
Where 2FA can still be beaten — and why that's not a reason to skip it
2FA isn't immune to every attack — SIM-swap fraud can, in rare cases, redirect SMS codes, and sophisticated phishing pages can relay both factors to an attacker in real time. But these attacks require far more effort and are far rarer than the mass password-leak attacks that plain passwords are defenceless against. 2FA doesn't promise perfect security; it promises that the cheap, automated attacks that succeed against passwords alone stop working. If authentication, cyber security or any other computer science topic needs explaining with the real mechanism rather than just advice to follow, that's exactly what our GCSE computer science tutoring is for — see the full learning pathway here.
Frequently asked questions
What are the three official 'factors' in authentication?
Something you know (a password or PIN), something you have (a phone, a hardware key, a bank card), and something you are (a fingerprint, face scan, or other biometric). Genuine multi-factor authentication combines at least two of these three categories — two passwords isn't 2FA, because they're both the same factor.
Is an SMS text code as secure as an authenticator app?
Not quite — SMS codes can, in rare but real cases, be intercepted through a 'SIM swap' attack, where someone tricks a phone provider into moving your number to their SIM card. Authenticator apps generate codes locally on your device without relying on the phone network, which closes that particular attack route, though both are far safer than a password alone.
Why do some services push 2FA so hard now, when they didn't before?
Because large-scale password leaks from unrelated breaches are now common, and many people reuse passwords across multiple sites — meaning one leaked password can compromise several accounts. 2FA became a priority once services recognised that a leaked password is no longer a rare event but something that will eventually happen to most accounts.
Reader ratings & reviews
Rate this article across a few different things — your rating helps other readers, and helps us improve.
Was this article helpful?
Tell us what you think — a correction, a question it left unanswered, or a topic you'd like covered next.
Prefer To Talk? Book a free video call at a time that suits you: 15 minutes for a quick question, 30 for anything else. Times show in your own time zone.
About the author
Sudershan Soni
Founder & Lead Tutor at Mostak Services — an MSc-qualified Mathematics, Science, Computer Science & STEM tutor with 20+ years of professional experience, teaching students from 11+ and GCSE to A-Level and beyond, online worldwide.
Read full profile