Two-step verification
Also called 2FA, MFA, multi-factor authentication, two-factor authentication, push bombing, MFA fatigue
Signing in with a second proof as well as your password, such as a code, an app approval, a passkey or a security key.
A password alone is one secret that can leak. A second step asks for something else, usually something on your phone, so a stolen password isn't enough. It's one of the most effective protections anyone can switch on.
Not all second steps are equal. Attackers have learned to relay codes: the fake page asks for your code, passes it straight to the real site, and keeps the logged-in session. Microsoft found this "in-the-middle" phishing was the most common technique it identified. Others flood you with approval requests until you tap yes to make them stop, known as push bombing or MFA fatigue.
AI-written lures make the fake pages more convincing, which is why the strongest options are the ones that don't rely on you spotting anything: passkeys and security keys simply won't work on the wrong site.
For example
After typing your password, you approve the sign-in on your phone, after checking the number on screen matches.
Put it to use
Where you'll meet two-step verification in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.