Back to blog
What is Two-Factor Authentication (2FA)?
Two-Factor Authentication (2FA) is the most common type of Multi-Factor Authentication (MFA). A security process that requires users - your customers and employees, for example - to provide two different authentication factors to verify their identity. The goal of 2FA is to add an extra layer of security beyond just a username and password, which are considered Single-Factor Authentication.
The two factors typically fall into the following categories:
Knowledge: Information only the user should know, the traditional username and password combination, for example.
Possession: A secondary piece of information that the user possess. A temporary verification code sent to a mobile or laptop, a USB or any other physical device.
Any combination of any two of the identifying factors listed above would be considered 2FA, but the most common combination includes the verification code, often referred to as One Time Passwords (OTP).
What is a One Time Password (OTP)?
A One Time Password (OTP) is a verification code designed to secure a single login attempt. These passwords or codes can be sent via different platforms and messaging channels. The most common ones are email and SMS, but can also be sent over RCS, WhatsApp and even Voice.
2FA across messaging channels
2FA via SMS & RCS
SMS is one of the most used messaging channels and serves billions of users around the world. One of the reasons for this success is the fact that SMS is native to every mobile device and can be received even without an internet connection. The reach and reliability of SMS make it an ideal channel for sending One Time Passwords or login codes.
RCS, or Rich Communication Services, is often seen as the successor of SMS. RCS offers many rich media features seen in other popular messaging channels, including images and profile verification, in combination with the reach and reliability of SMS. It provides a new way to deliver One Time Passwords to Android users.
2FA via Email
Email remains a valuable and accessible channel for One Time Passwords, especially when the business does not have access to the customer's mobile number, or even when the customer personally chooses to receive One Time Passwords in this manner.
2FA via WhatsApp
WhatsApp is one of the most popular social messaging apps with over two billion users worldwide, collectively sending 100 billion messages each day on average. Yet, it isn't purely about the global reach that makes this channel key for 2FA, WhatsApp OTPs are encrypted from end to end, making it one of the safest options available.
With this, it's no surprise that WhatsApp Business is a popular choice for sending One Time Password. However, one caveat is that customers need to opt-in to receive messages via this channel.
2FA via Voice
Voice is an accessible channel to share One Time Passwords if a business is not using online messaging channels or customers benefit from spoken communication rather than written text. One Time Passwords over Voice via a Voice OTP allow businesses to reach customers with limited sight, without mobile phones, or even destinations that are not reachable by SMS. It's available in different spoken languages and voices. Voice can even be used as a backup channel in case SMS OTPs aren't delivered.
2FA via Push Notifications
Push notifications are an ideal channel to use if customers have access to a business's native app. With these push notifications, customers can approve an online payment and then confirm it via the app.
2FA via Authenticator Apps
Authenticator Apps generate codes locally based on a secret key and can be secured and synced across multiple devices. These types of apps are more often used to secure internal employees, as the user is required to download another app.
What channel is the best fit for your business?
First and foremost, protecting business and customer data should be the top priority for every business. With each technological advance, malicious parties will find new ways to hack accounts and steal data. Of course, most businesses have measures for security, data protection, and compliance in place, but Two-Factor Authentication (2FA) can minimise the risk even more.
But, what channel is the best fit for your business? That depends on the use case, strategy, and your customers' preferences. Discover the best channel for your business via our Communication Channel Advisor.
Are you ready to implement Two-Factor Authentication? With the One Time Password API from CM.com, you can send OTPs via any channel. Read out and speak to one of our experts to discuss your specific use case and help you choose the perfect messaging channel for your 2FA strategy.
+44 20 3868 7140
