Two-factor authentication (2FA)
Login protection that requires a second factor in addition to the password: code from an app, SMS, or hardware token.
Two-factor authentication (2FA) requires a second independent factor at login on top of the password – usually a 6-digit code from an app (TOTP), an SMS, or a hardware token like YubiKey.
Even if the password is stolen, the attacker cannot log in without the second factor. NCSC recommends 2FA for every important account (email, banking, cloud).
Why this matters in 2026
NCSC has named 2FA the "single most important step" for account security since 2024. SMS-based 2FA is considered insecure in 2026 (SIM-swap attacks are rising) – authenticator apps or hardware tokens (YubiKey, FIDO2) are the standard. Swiss banks now enforce 2FA broadly.
How to protect yourself
Use an authenticator app (Google, Microsoft, Aegis, Raivo) instead of SMS – TOTP works offline and is resistant to SIM swap. Print backup codes and store them safely. Hardware tokens (YubiKey 5C) for the highest security on critical accounts (email, banking).