What Is Two-Factor Authentication, and Should Seniors Be Using It?

If you’ve ever logged into your bank, email, Facebook or another online account and then been asked to enter a code sent to your phone, you’ve already used two-factor authentication.

It can feel like an extra nuisance at first.

You may think:

“Why do I need another code?”
“Isn’t my password enough?”
“Why does it keep asking me to verify myself?”

The simple answer is that two-factor authentication gives your account an extra layer of protection.

And for seniors, it is absolutely worth using.

What is two-factor authentication?

Two-factor authentication is often shortened to 2FA.

You may also hear it called multi-factor authentication, or MFA.

Two-factor authentication means that instead of using only one thing to prove who you are, such as your password, you use two different things.

For example:

1. You enter your password.
2. A code is sent to your mobile phone.
3. You enter that code.
4. You are allowed into the account.

The Australian Cyber Security Centre describes multi-factor authentication as one of the most effective ways to protect your accounts against unauthorised access.

Think of it like two locks on your front door

A simple way to think about it is this:

Your password is the first lock.

The code sent to your phone is the second lock.

If a scammer somehow gets your password, they may still not be able to get into your account because they do not have your phone or the second form of verification.

The Australian Cyber Security Centre actually compares MFA to adding an extra security screen to your home.

What can the second step be?

It is not always a text message.

The second step might be:

• A code sent by SMS
• A code generated by an authenticator app
• A notification on your phone asking you to approve the login
• Your fingerprint
• Face recognition
• A physical security key
• A passkey

All of these are designed to provide another way of proving that it is really you trying to access the account.

Why is this so important?

Passwords can be stolen.

That can happen through:

• Scam emails
• Fake websites
• Data breaches
• Viruses or malicious software
• Reusing the same password on different websites
• Someone simply guessing an easy password

If someone gets your password and that is the only protection on the account, they may be able to log straight in.

If two-factor authentication is turned on, they have another hurdle to get past.

That is why the Australian Cyber Security Centre recommends using MFA wherever possible, especially on accounts containing sensitive information.

Which accounts should seniors protect first?

Ideally, you should turn two-factor authentication on wherever it is available.

But if that sounds overwhelming, start with your most important accounts.

I would suggest prioritising:

• Your main email account
• Online banking
• myGov
• Facebook
• Apple ID
• Google account
• Microsoft account
• PayPal
• Superannuation accounts
• Online shopping accounts that have payment details saved

Your email account is especially important.

If someone gets into your email, they may be able to reset passwords for many of your other accounts.

What about banking?

Most Australian banks already use some form of additional verification for certain activities.

You may receive a code when:

• Logging in from a new device
• Transferring money
• Adding a new payee
• Changing account details
• Making certain purchases

That extra step is there to protect you.

Do not treat these codes as an inconvenience. They are doing an important job.

The most important rule: never give anyone your code

This is extremely important.

If you receive a two-factor authentication code, do not tell it to anyone.

That includes someone who claims to be from:

• Your bank
• Telstra
• Microsoft
• Apple
• Google
• The police
• A government department
• Technical support

Scammers sometimes already have your password.

All they need is the security code that has just been sent to your phone.

They may call you and say something like:

“I’ve just sent you a verification code. Can you read it back to me?”

Do not do it.

The Australian Cyber Security Centre specifically advises people never to approve unknown sign-in attempts or share MFA codes.

Scamwatch also warns never to provide two-factor identification codes over the phone.

What if a code arrives when I am not logging in?

Pay attention to this.

If you suddenly receive a login code when you have not tried to log into anything, someone else may be trying to access your account.

Do not approve the login.

Do not give anyone the code.

Instead:

• Open the official app or website yourself
• Check for suspicious activity
• Change your password if necessary
• Make sure two-factor authentication is still turned on

If you are worried, ask someone you trust for help.

SMS codes are good, but there are stronger options

Receiving a code by text message is much safer than using a password alone.

However, SMS is not the strongest possible method.

Scammers can sometimes take control of a mobile number through something called SIM swapping or number porting. Scamwatch warns that this can allow criminals to receive SMS authentication codes intended for the real account holder.

Where available, stronger options include:

• Authenticator apps
• Passkeys
• Security keys
• Fingerprint or facial recognition

The Australian Cyber Security Centre currently recommends phishing-resistant MFA such as passkeys where supported, and authenticator apps where passkeys are not available.

That said, do not let this become confusing.

If your choice is between:

• Password only

or

• Password plus an SMS code

Choose the SMS code.

It is still a significant improvement.

What is an authenticator app?

An authenticator app is an app on your phone that generates a changing security code.

Common examples include:

• Microsoft Authenticator
• Google Authenticator

Instead of waiting for a text message, you open the app and enter the code shown on the screen.

These codes usually change every 30 seconds or so.

They can look confusing the first time you use them, but once they are set up, they are generally quite easy.

What is a passkey?

You may also start seeing the word passkey more often.

A passkey is a newer way of logging in that can use your phone, fingerprint, face recognition or device PIN instead of relying on a traditional password.

Passkeys are designed to make accounts both easier to use and harder for scammers to steal.

You do not need to rush out and change everything today, but expect to see passkeys becoming increasingly common.

Will two-factor authentication make things harder?

A little bit, perhaps.

It may occasionally mean reaching for your phone and entering a six-digit number.

But that small inconvenience can make a big difference to your security.

In many cases, your computer or phone can also remember that you have already verified the device, so you may not need to enter a code every single time.

What happens if I lose my phone?

This is worth thinking about before there is a problem.

When you turn on two-factor authentication, many services offer:

• A backup phone number
• A recovery email
• Backup codes
• Another trusted device

If backup codes are provided, keep them somewhere safe.

If you use an authenticator app and buy a new phone, make sure your authenticator is transferred before resetting or disposing of your old phone. The Australian Cyber Security Centre recommends checking your recovery methods and transferring authenticator access when changing devices or phone numbers.

Should seniors use two-factor authentication?

Yes.

For most seniors, two-factor authentication is one of the simplest security improvements you can make.

You do not need to understand all the technology behind it.

Just remember:

Your password is one lock.
Two-factor authentication adds another.

If someone steals your password, that second lock may be what keeps them out.

A simple starting point

If you want to improve your online security without becoming overwhelmed, start with these three accounts:

1. Your main email account
2. Your bank
3. Your myGov account

Then gradually work through your other important accounts.

There is no need to do everything in one afternoon.

One final warning

Two-factor authentication protects you, but scammers may try to trick you into defeating it yourself.

If someone phones, texts or emails asking for:

• A verification code
• A one-time password
• An authentication number
• Approval of a login notification

Stop.

Do not give it to them.

If you are unsure whether the contact is genuine, hang up and contact the organisation yourself using the official phone number from its website or app.

Need a hand?

If you would like help setting up two-factor authentication on your email, Facebook, Google, Microsoft or other accounts, we’re always happy to assist.

Senior Tech Assist provides friendly, patient technology help for seniors across the Sunshine Coast.

I can help you set it up properly, explain how it works, and make sure you know what to do when those verification messages appear.

Senior Tech Assist
0435 415 873