Two-factor authentication explained: apps versus SMS

Last updated: 4 November 2026

A padlock in front of a cloud, with a key.

A password on its own is one lock on the door. Two-factor authentication (also called multi-factor authentication, or MFA) adds a second one. Here's how it works, and how to pick between an authenticator app and an SMS code.

1. What it is

With two-factor turned on, logging in takes your password plus a second step, usually a short one-time code. The Australian Cyber Security Centre (ACSC) describes MFA as using two or more different types of checks to get into your account, such as a code sent by text after you enter your password.

2. Why it helps

The ACSC calls MFA one of the best ways to protect against someone breaking into your account, because it adds extra layers. It doesn't make an account unbreakable, but it means a stolen password alone is usually not enough. The ACSC suggests turning it on wherever you can, especially for your main email, banking and other sensitive accounts.

3. SMS codes

Many services text you a code when you log in. - Good: nothing to install, and it works on almost any phone. - Not so good: the ACSC says SMS and email codes are less secure than other forms of MFA.

SMS is still far better than nothing. If it's the only option offered, use it.

4. Authenticator apps

An authenticator app on your phone makes a fresh six-digit code every 30 seconds. You link it to an account by scanning a QR code in that account's security settings. - Good: the ACSC says authenticator apps are more secure than codes sent by SMS or email. They also work without mobile reception. - Not so good: a little more setup, and you need to move the app across carefully when you change phones.

Download one from your phone's official app store, from a company you can identify.

If a service offers passkeys, consider them too. The ACSC now lists passkeys as a more secure way to log in than passwords.

5. Backup codes: do this on day one

When you turn on two-factor, most services offer a set of backup (recovery) codes. The ACSC recommends adding a recovery method and saving your backup codes in case you lose access to your authenticator app. Keep them somewhere safe and separate from your phone, such as a password manager or a printed copy at home.

6. If you lose or change your phone

New phone: move your authenticator app across before you reset or get rid of the old one. Some services need you to turn MFA off and on again.
New number: update your SMS sign-in options before you lose the old number.
Lost phone: use your backup codes to get in, then set up two-factor again on your new phone. If you're locked out, use the service's official account recovery page, found by typing its address yourself.

7. Never share a code

The ACSC warns never to share an MFA code or approve a sign-in you didn't start. A real company won't ask you for one. If someone does, it's a scam: report it to Scamwatch.

The short version

Turn on two-factor for email, banking and other important accounts first.
An authenticator app is the stronger choice. SMS is fine when it's all that's offered.
Save your backup codes the day you set it up.
Move your app before changing phones.
Never share a code or approve a sign-in you didn't start.

We don't list prices here, because they change depending on where you are. Check the provider's own site for current prices and plans.