Like a door with two locks instead of just one, Two-Factor Authentication (2FA) systems are based on a 1st Factor (typically a Password) and a 2nd Factor (typically a Time-Based One-Time Password aka TOTP /OTP).
Conventional login is generally a combination of an identifier (called the username) and a password which together comprise only on authentication factor. Since passwords are no longer trustworthy the security industry introduced 2FA using codes provided to the user either by text messages, email, or authenticator applications.
This new layer of a second factor helps improve the overall security to access online accounts but introduce friction to the end user’s experience. Furthermore, hackers have already adapted to text-based 2FA compromising it to where authorities and security professionals no longer support SMS-based 2FA. Still, when available 2FA should be enabled but never totally trusted.
Example:
"A majority of our students use weak passwords and are actually very easy to guess, so we implemented two-factor authentication to make use accounts more secure. By forcing users to log in with an added layer of security, we've reduced the risk of an account takeover."
