Two-Factor Authentication
What Is Two-Factor Authentication (2FA)? Definition and How It Works
Definition
Two-factor authentication (2FA) is an authentication method that requires a user to verify their identity using two distinct factors from different categories: something they know (a password or PIN), something they have (a mobile device, hardware token, or authenticator app), or something they are (a biometric such as a fingerprint or face scan). In payments, 2FA is the conceptual basis for Strong Customer Authentication (SCA) under PSD2 and for 3DS cardholder authentication.
How it works
2FA combines two independent authentication factors in a single login or transaction approval flow. The most common implementation is a password (knowledge factor) combined with a one-time passcode sent to a mobile device via SMS or generated by an authenticator application (possession factor). The user must provide both the correct password and the correct OTP to complete authentication.
Authentication factor categories are defined precisely. Knowledge factors are things only the user should know: passwords, PINs, security question answers, and passphrases. Possession factors are physical or digital objects the user has: a registered mobile phone number (for SMS OTP), a hardware security key (YubiKey, Titan Key), an authenticator application (Google Authenticator, Authy), or a smart card. Inherence factors are biological or behavioural characteristics: fingerprints, facial geometry, iris patterns, and voice patterns.
For payment authentication, the specific 2FA implementation matters. SMS OTP combines knowledge (knowing the account) with possession (having the SIM), but is vulnerable to SIM-swapping attacks where fraudsters transfer a victim's number to their own SIM and intercept the OTP. Authenticator apps are more secure because they generate OTPs locally on the device without network transmission. FIDO2 passkeys combine possession (the device) with inherence (biometric) in a phishing-resistant, uninterceptable implementation.
Under PSD2 SCA requirements, payment authentication must use two factors from distinct categories, and at least one factor must be linked to the specific payment amount and payee so that the authentication code is dynamic and transaction-specific, not reusable across different transactions.
Why it matters
2FA dramatically reduces account takeover risk. Passwords alone are weak: they are reused across services, stolen in data breaches, phished, and guessed. Adding a second factor means a stolen password is insufficient to access an account or authorise a payment. The majority of credential-based account takeovers are defeated by 2FA because the attacker has only one factor.
In payments, 2FA (as SCA) serves a regulatory function as well as a security function. PSD2 mandates SCA for electronic payment initiation and account access across the EU and UK, with specific technical requirements for what constitutes valid 2FA. Non-compliance exposes payment institutions to regulatory penalties and shifts fraud liability to the non-compliant party.
The transition from SMS OTP to app-based and hardware-based 2FA is an active security improvement priority across the payments industry. SIM-swapping attacks targeting SMS OTP are a known fraud vector used to take over accounts and intercept payment authentication codes. FIDO2-based authentication (passkeys, hardware security keys) eliminates this attack vector entirely.
With PXP
PXP supports merchants and partners across the payments value chain. To talk through strong customer authentication as part of your payment strategy, get in touch with our team.
Frequently asked questions
What is the difference between 2FA and MFA?
Two-factor authentication (2FA) requires exactly two verification factors. Multi-factor authentication (MFA) is the broader term for authentication using two or more factors. All 2FA is MFA, but MFA can require three or more factors. In practice, the terms are often used interchangeably. For payment authentication under PSD2 SCA, exactly two factors from distinct categories are required, making 2FA the standard implementation.
Why is SMS OTP considered less secure than app-based 2FA?
SMS OTPs are transmitted over the mobile network, which is vulnerable to SIM-swapping (where a fraudster convinces the carrier to transfer the victim's number to a new SIM, intercepting all SMS messages) and SS7 network attacks (interception of SMS in transit). Authenticator app OTPs are generated locally on the device using a shared secret, without any network transmission, making them immune to interception. FIDO2 passkeys go further: they use public-key cryptography and cannot be phished because the credential is bound to the specific legitimate website domain.
Is 2FA required for all payments under PSD2?
SCA (which requires 2FA equivalent authentication) applies to most electronic payment transactions in the EU and UK, but with a range of exemptions. Low-value transactions (under EUR 30), trusted beneficiaries, recurring transactions with consistent amount and payee, merchant-initiated transactions, and transactions below risk thresholds under Transaction Risk Analysis are exempt from per-transaction SCA. The exemption framework is designed to reduce authentication friction on lower-risk transactions while maintaining security for higher-risk payments.
Revolutionize your business with PXP
Take complete control of your commerce and payments with one platform.
Get Started