A verified account is only as secure as its authentication stack. Two-factor authentication (2FA) is the single largest lever most users have over account-takeover risk, and the choice of factor matters more than most users realize.
1. SMS one-time codes. SMS remains the most widely deployed 2FA method because every user has a phone number. It is also the weakest widely used method: SIM-swap attacks — where an attacker convinces the mobile carrier to port the target's number to a new SIM — have driven a well-documented tail of high-value account takeovers. SMS 2FA is materially better than password-only, but it should not be the primary factor on a high-value account.
2. Time-based one-time passwords (TOTP). TOTP apps like Google Authenticator, Authy, 1Password, and Aegis generate a rotating six-digit code from a shared secret. Because the secret never leaves the device, TOTP is not vulnerable to SIM swaps. Its main weakness is device loss without a backup — enrolling TOTP without recording the recovery seed is a common cause of account lockouts.
3. Push-based approvals. Some platforms send a push notification to a mobile app; the user approves or denies with a tap. Convenience is high; risk is that a user under time pressure or targeted by prompt-bombing approves a malicious request. Enabling number-matching (where the user types a code shown on the login screen) materially closes that gap.
4. Passkeys. Passkeys are FIDO2 credentials bound to a device (phone, laptop) and synced across a user's ecosystem via iCloud Keychain, Google Password Manager, or a third-party manager. They are phishing-resistant because the credential is bound to the origin domain — a fake login page cannot elicit a valid signature. Passkeys are the default recommendation for most consumer accounts in 2026.
5. Hardware security keys. YubiKey, SoloKey, and comparable devices are FIDO2/WebAuthn hardware tokens. They offer the strongest available factor: phishing-resistant, immune to malware on the host, and requiring physical presence. High-value crypto and financial accounts commonly enroll two hardware keys — a primary and a backup stored separately.
6. Recovery codes. Every 2FA-enabled account generates recovery codes at enrollment. These codes bypass the second factor and should be stored offline (printed, in a fireproof safe, or in a hardware password manager). Storing recovery codes in the same cloud drive as everything else defeats the point.
7. Anti-phishing codes. Some exchanges — Binance, Kraken, and others — allow users to set a personal anti-phishing code that appears in every legitimate email from the exchange. A message missing the code is a phishing attempt. This is a small feature with an outsized effect on email-based social-engineering resistance.
8. Withdrawal address whitelists. Beyond login 2FA, most exchanges support a whitelist of addresses assets can be withdrawn to. Combined with a delay window before new addresses become active, whitelists convert a full account takeover into a much narrower attacker capability. Enabling both is a standard step for accounts holding meaningful balances.
The practical recommendation is straightforward: passkeys or hardware keys as the primary factor, TOTP as a backup, recovery codes offline, and SMS disabled where the platform allows. Verified accounts deserve verification-grade authentication.