Is Two-Factor Authentication Safe? 3 Myths Holding Back 2FA Adoption

Two-factor authentication (2FA) is safe, and far safer than a password alone. Microsoft has reported that it blocks 99.9% of automated attacks on accounts. The three myths that hold organisations back (that employees won't accept it, that it's clunky, and that it's not secure) don't stand up to the evidence. Any organisation handling confidential board or deal documents should make 2FA mandatory.

What is two-factor authentication?

Two-factor authentication adds a second check when you sign in. After entering your password, you confirm your identity with something you have (such as your phone or a security key) or something you are (such as your fingerprint or face). Even if an attacker steals your password, they can't get in without that second factor.

It is one of the most effective protections against password breaches, yet stories about low adoption and supposed weaknesses still put some organisations off. Here is why those myths don't hold.

Myth 1: Employees won't accept 2FA

This belief comes from headlines about people resisting 2FA in their personal lives. A widely reported example was a Google engineer revealing that fewer than ten percent of users had turned on the company's 2FA option, years after it became available.

The tide has turned since. In 2021, Google announced it would auto-enrol 150 million users in two-step verification, a move designed to change user habits at scale.

Research by authentication specialist Duo found that 79% of people had used 2FA in 2021, up from 53% in 2019, with adoption higher among people in work. Research by LastPass had already found that 57% of businesses worldwide were using multi-factor authentication in 2019.

Hybrid working has accelerated the trend, as organisations protect remote access to their systems. Today, 2FA is the norm rather than the exception, and an accepted part of working life.

Myth 2: 2FA is a poor user experience

Early 2FA rollouts relied on hardware tokens that generated one-time passwords, which gave the technology a clunky reputation. That is no longer the case. The second factor can now be a tap in an authenticator app, a code by text message, a fingerprint, facial recognition or a passkey stored on your device.

People already use facial recognition for everything from banking to hiring an electric scooter. Signing in to work systems can be just as quick, so the step for users is a small one.

Myth 3: 2FA isn't as secure as it promises

A quick search will turn up commentators arguing that 2FA isn't completely secure. They point to bots that intercept one-time codes and to SIM-swap attacks, in which criminals take over a victim's phone number to receive their text-message codes. Several high-profile executives have had accounts hijacked this way.

These attacks are relatively rare, and there are answers to them. Hardware security keys and passkeys can't be phished or intercepted over the air, and authenticator apps and biometrics are much harder to compromise than codes sent by text.

Above all, any form of 2FA is vastly more secure than a password alone. According to Microsoft, 2FA prevents 99.9% of automated attacks on accounts. And the pressure on passwords keeps rising: password-stealing attacks rose by 45% in just six months in 2021, driven largely by the shift to remote working.

Which 2FA method is the most secure?

From most to least secure, the common methods are:

1. Hardware security keys and passkeys: resistant to phishing and interception
2. Authenticator apps and biometrics: strong protection and easy to use day to day
3. Codes by text message (SMS): much better than nothing, but exposed to SIM swapping

The best method is the strongest one your users will actually adopt. For most organisations, that means an authenticator app as the default, with security keys or passkeys for the most sensitive accounts.

How should boards and deal teams use 2FA?

Board members and deal teams handle some of the most sensitive information in any organisation: strategy papers, financial forecasts and confidential transaction documents. They are also prime targets for phishing and impersonation. For these users, 2FA should be mandatory, not optional.

At Admincontrol, we encourage all customers to activate 2FA on our Virtual Data Room and Board Portal. Our help centre explains how to set up two-factor login, and you can read more about how we secure your data. For more simple steps, see three steps to secure your account and reduce cyber risk.

Frequently asked questions about 2FA

Is two-factor authentication safe?

Yes. 2FA is one of the most effective ways to protect an account, because a stolen password alone is no longer enough to get in. No security measure is perfect, but 2FA blocks the vast majority of automated attacks on accounts.

Can two-factor authentication be hacked?

Some forms can be bypassed in targeted attacks, for example by SIM swapping to intercept text-message codes or by phishing sites that relay codes in real time. Hardware security keys and passkeys are resistant to these techniques, and authenticator apps are much harder to compromise than SMS.

What is the difference between 2FA and MFA?

Two-factor authentication (2FA) uses exactly two factors, such as a password and a code. Multi-factor authentication (MFA) means two or more factors. 2FA is the most common form of MFA.

Is 2FA worth it for small organisations?

Yes. Attackers often target smaller organisations because they expect weaker defences. 2FA is low-cost, quick to roll out and protects against the most common account attacks.

The message is clear: any organisation that wants to protect critical data and systems should implement 2FA and make sure employees use it as soon as possible. To find out more about other ways to increase security, read our handbook on managing the impact of hybrid working on cybersecurity.