Why does that website keep texting me a code?

Liz has just logged in to her bank. Password typed, correctly, first try. And now the bank wants a code from a text message. Again.

“It's like logging in twice!” she says.

Dan's answer: that's because she is. On purpose.

The password problem

Here's the story Dan tells her. Years ago, Liz bought something from a little online shop. She made an account, picked a password, and forgot all about it. Then the shop got hacked, and its list of passwords leaked.

Now a stranger has that password. “Good thing it's only for that shop,” says Liz.

Is it, though? Like most of us, Liz had used the same password somewhere else. Her email, for instance. Criminals know this, so stolen passwords get tried on other sites, over and over. Regulators even have a name for it: credential stuffing.

And email is the big prize. Every “forgot your password?” link sends a reset to your inbox. So whoever gets into your email can reset your other passwords, one after another. With only a password standing in the way, the thief walks right in.

The second lock

That code is the fix. It's called two-factor authentication, or 2FA for short (you'll also see “multi-factor authentication”, or MFA, which means the same idea). It adds a second lock that a leaked password can't open.

It works because it asks for two different kinds of proof:

• Something you know: your password.
• Something you have: your phone, where the code arrives.

The thief in Dan's story has the password. But the thief doesn't have Liz's phone. No phone, no code, no way in.

Liz spotted that she already does this every week: her bank card and its PIN. The card is the thing she has, the PIN is the thing she knows, and a stranger who finds only one of them can't take her money.

The trick scammers use

There's one way around the second lock, and it's not clever technology. It's a phone call.

A scammer who has your password calls you, pretending to be your bank. They sound official. They say there's a problem with your account and that they've just sent you a code “to verify it's you”. Could you read it out?

That code is the second lock, and they're asking you to open it for them. So the rule is simple: never share the code with anyone. Your real bank won't call to ask for it. If a call makes you nervous, hang up and call the number on the back of your card.

What the video left out: text codes, apps and keys

The video kept to text codes, because that's what most people meet first. But they're not the only kind, and they're not the strongest.

Scammers can sometimes trick a phone company into moving your phone number to their own SIM card (the little chip that ties a phone to its number), which is called a SIM swap. Then your text codes go to them. The US Federal Trade Commission (FTC) says authenticator apps are safer for that reason: the app makes the codes on your own phone, so a stolen phone number doesn't get them. Security keys, small gadgets you plug in or tap, are the strongest option of all.

Don't let that scare you off text codes, though. The FTC calls them better than nothing, and the US cybersecurity agency, CISA, puts it even more simply: any MFA is better than no MFA. A text code still blocks the most common attack: a thief armed with nothing but a leaked password.

That's also why the video says a stolen password alone shouldn't get a thief in, not that it never can. 2FA is a strong lock, not a magic one.

Still annoying?

Still annoying, Liz admits. But a few seconds for her is a locked door for a thief. That's a good trade.

What you can do

• Turn on 2FA for your email first, then your bank and any shopping or social accounts. Look for “two-step verification” or “two-factor” in the account's security settings.
• Never share a code with anyone who calls, texts or emails you, whoever they say they are.
• If an account offers an authenticator app, consider switching from text codes to the app.
• Stop reusing passwords, starting with your email's. A password manager can remember them for you.