The Paper in the Drawer: Rethinking How Two-Factor Authentication Actually Fails

For years, the standard counsel after every breach has been the same: turn on two-factor authentication. It is good advice, and the evidence supports it — Microsoft researchers estimated in 2019 that MFA blocks the overwhelming majority of automated account takeover attempts. But a curious gap has opened between the industry's enthusiasm for enabling 2FA and its candor about how 2FA breaks.

Talk to security practitioners who handle real incidents, and a different picture emerges: the second factor is not a wall but a chain, and every link has a failure mode.

The SIM Swap Problem

The most widely used second factor in the United States is also the most fragile: the SMS code. Text-message authentication depends on the integrity of the phone number, and phone numbers are controlled by carriers — institutions with uneven security cultures and, historically, cooperative customer-service scripts.

A SIM-swap attack exploits this. A fraudster convinces or bribes a carrier employee to transfer a victim's number to a new SIM card, intercepts the texted codes, and walks past the second factor as if it were not there. High-profile cases involving cryptocurrency investors and celebrities have made the technique notorious, but researchers stress that the victims of routine SIM swaps number in the thousands, and most never make headlines.

Carriers have improved — port-out PINs and stricter identity checks are now common — but the fundamental architecture remains vulnerable to human failure at the phone company.

The Backup Code Dilemma

Then there is the quieter failure mode: recovery. Every serious 2FA system issues backup codes for the moment a user loses their device. What users do with those codes is a study in human behavior. Security researchers who have audited personal and corporate accounts describe printouts folded into wallets, codes saved in plain-text notes, and one recurring image — a handwritten list in a desk drawer, directly beneath the passport and the spare checkbook.

The paradox is uncomfortable. The backup codes are often the single most sensitive credential in a person's digital life — a skeleton key that typically bypasses the second factor entirely — yet they are treated with less care than a grocery list. An attacker who compromises a desk, a cloud-synced notes folder, or an email archive may find that the second factor was never the last line of defense.

Ranking the Second Factors

Based on the consensus of researchers who study account takeover, a rough hierarchy of resilience has emerged:

1. Hardware security keys (FIDO2/WebAuthn, such as YubiKeys or platform passkeys). Cryptographically bound to the legitimate site, resistant to phishing by design. The strongest widely available option, with the caveat of cost and the risk of loss — mitigated by registering a backup key.
2. Authenticator apps (TOTP codes). Phishable in theory, but resistant to SIM swaps and adequate for most threat models.
3. Push approvals with number matching. Better than naive push, though users still fat-finger approvals under fatigue — a phenomenon researchers call "push bombing."
4. SMS codes. Better than nothing, genuinely — but the weakest common method, hostage to carrier security.

The rise of passkeys, which replace both passwords and second factors with device-bound cryptography, may eventually dissolve this debate. Adoption, however, remains uneven across the services Americans actually use.

An Honest Conversation Overdue

None of this argues against 2FA. It argues for matching the method to the stakes. A social media account and a bank account do not warrant the same defenses, and pretending that a checkbox labeled "two-factor enabled" means the same thing across all of them obscures more than it protects.

The practical guidance is unglamorous: prefer an authenticator app or hardware key for anything financial; lock down your carrier account with a port-out PIN; store backup codes deliberately — printed, sealed, and somewhere a thief would have to work to find — rather than incidentally. Two-factor authentication is not a spell. It is a system, and systems deserve to be understood, not merely switched on.