The use of two independent mechanisms to verify the identity of a user. Two-factor authentication (2FA) is also called "2-step verification" (2SV). There are four factors:
#1. What you know (password, PIN, personal data).
#2. What you have (private key, authentication token, cellphone).
#3. What you are (biometric scan).
#4. What you do (speak, write).
One Each From Any Two
2FA requires one factor from any two of the above four categories; for example, a password and phone (#1 and #2) or a password and fingerprint scan (#1 and #3). A password plus a question such as "what city were you born" may be two factors, but they both fall into category #1. See
FIDO,
multi-factor authentication,
authentication,
smart card,
password and
one-time password.
Cellphone Second Factor
A common two-factor method is a number texted to the user's cellphone after logging into a site with username and password. The number must be copied to the website as in this example to complete the login. In this case, username and password are factor #1, and the phone is #2.
A Backup for 2FA
In this example, users are given a temporary authentication code in case the phone were lost.