Two-factor authentication (2FA) has quietly become one of the most effective things any organisation can do to keep cyber criminals out of its accounts, even when a password has already been stolen.
For community transport operators, dial-a-ride schemes, charities and the local authority and NHS teams they work alongside, that protection matters more than ever. The people you serve trust you with sensitive information about their journeys, their health needs and their homes, and a single compromised login can put all of it at risk.
This guide explains what two-factor authentication is, how it works, and how it differs from two-step verification and multi-factor authentication. It covers the main methods in use today, why text message codes are now the weakest option, and how passkeys are changing the picture entirely.
Throughout, we lean on UK guidance from the National Cyber Security Centre (NCSC) rather than generic advice, so the recommendations reflect what is expected of organisations here.
Key Takeaways
- Two-factor authentication adds a second proof of identity on top of your password, so a stolen password alone is no longer enough to break into an account.
- The terms two-factor authentication (2FA), two-step verification (2SV) and multi-factor authentication (MFA) are used to describe the same basic idea. The NCSC treats them as interchangeable.
- Authenticator apps and passkeys are far safer than codes sent by text message, which can be intercepted through SIM swapping.
- Phishing is the most common cyber threat facing UK charities and small organisations, and 2FA is one of the strongest defences against it.
- Passkeys are now the direction of travel. The NCSC recommends them as the default sign-in method for consumers, and billions are already in use worldwide.
- Always set up backup codes so you are not locked out if a phone is lost, stolen or out of battery.
What is two-factor authentication?
Two-factor authentication is a security process that asks you to prove your identity in two different ways before you can sign in. The first proof is usually your password. The second is something separate, such as a one-time code from an app, a fingerprint, or a tap on your phone. Because the two proofs are distinct, an attacker who has guessed or stolen your password still cannot get in without the second factor.
The idea rests on three categories of proof. Security professionals refer to them as authentication factors:
- Something you know, such as a password or PIN. This is the knowledge factor.
- Something you have, such as a mobile phone, an authenticator app or a hardware security key. This is the possession factor.
- Something you are, such as a fingerprint or a face scan. This is the inherence factor.
Genuine two-factor authentication combines two of these three categories. Pairing a password with a security question does not count, because both are things you know. True 2FA works because the two factors are hard for the same attacker to obtain at once. Stealing a password is easy at scale. Stealing a password and a physical phone at the same moment is far harder.
Why 2FA matters for community transport and charities
Passwords on their own have become a liability. Research by Google found that only around a third of people use a unique password for every account, which means most of us reuse the same handful of passwords across dozens of services. When one site is breached, those reused credentials can be tried automatically against everything else you use.
The scale of the problem in the UK is set out in the government's Cyber Security Breaches Survey 2025 to 2026. It found that 43 per cent of businesses and 28 per cent of charities had experienced a cyber breach or attack in the previous twelve months. Phishing, where criminals trick people into handing over their login details, was by far the most common type, and accounted for the overwhelming majority of cybercrime affecting charities.
This is exactly the sector Road XS serves. Community transport organisations are often small, run on tight budgets, and rely heavily on volunteers and part-time coordinators. That combination makes strong technical controls harder to maintain, which is precisely why a simple, high-impact step like two-factor authentication is so valuable. Microsoft has estimated that multi-factor authentication blocks more than 99 per cent of automated attempts to compromise accounts. Few security measures offer that much protection for so little effort.
There is a duty-of-care angle too. Transport records hold names, addresses, mobility needs and often health information about passengers. Under UK GDPR, keeping that data secure is a legal obligation, and unauthorised access is the kind of incident that can trigger a report to the Information Commissioner's Office. Turning on 2FA across the accounts that touch this data is one of the clearest ways to show you take that responsibility seriously.
How does two-factor authentication work?
The process is straightforward from the user's point of view. You enter your username and password as usual. Instead of letting you straight in, the service then asks for a second step. That might be a six-digit code from an authenticator app, a prompt on your phone asking you to approve the sign-in, or a fingerprint. Only once both steps are satisfied are you granted access.
Behind the scenes, most 2FA methods rely on short-lived codes. A time-based one-time password, or TOTP, is generated from a shared secret and the current time, and changes every thirty seconds or so. Because the code expires almost immediately, an attacker who somehow sees it has a very narrow window to use it. This is what makes a rolling code far stronger than a static one that could be reused again and again.
Sensible services do not demand a second factor on every single login. The NCSC advises organisations to prompt for it only when it makes a difference, for example when signing in from an unfamiliar device or an unusual location, or when carrying out a sensitive action. That balance keeps accounts secure without wearing users down with constant prompts.
2FA vs two-step verification vs MFA
One of the most common questions is whether two-factor authentication, two-step verification and multi-factor authentication are different things. In practice they describe the same basic protection, and the NCSC uses the terms interchangeably. The subtle distinctions are worth knowing all the same.
- Two-factor authentication (2FA) specifically means two factors drawn from two of the three categories, for example a password plus a fingerprint.
- Two-step verification (2SV) is the NCSC's preferred everyday term. It means two steps in the sign-in process, which usually amounts to the same thing.
- Multi-factor authentication (MFA) is the umbrella term. It covers any approach using two or more factors, so all 2FA is a form of MFA, but MFA can also involve three or more checks for higher-risk systems.
For most community transport organisations, the practical takeaway is simple. Wherever you see an option labelled 2FA, 2SV or MFA in your account settings, it is worth switching on, and the differences in wording need not slow you down.
The main two-factor authentication methods
Not every second factor offers the same level of protection. Here are the methods you are most likely to meet, roughly in order of strength.
Text message (SMS) codes
A code is sent to your phone by text, and you type it in. This is the most widely offered method and better than no second factor at all, but the NCSC notes it is the least secure option because text messages can be intercepted or redirected. Use it only where nothing stronger is available.
Authenticator apps
Apps such as Google Authenticator and Microsoft Authenticator generate rolling codes directly on your device. They work without a mobile signal, do not rely on a text arriving, and cannot be intercepted in transit, which makes them a clear step up from SMS. They are a sensible default for most organisations and are free to use.
Push notifications
Instead of typing a code, you receive a prompt on a trusted device and simply approve or deny the sign-in. Push approvals are convenient and remove the risk of mistyping a code. The one thing to watch is prompt fatigue, where users tap approve out of habit, so treat an unexpected prompt as a warning sign rather than a nuisance.
Biometrics
Fingerprint and facial recognition use something unique to you as the second factor. Modern smartphones and laptops have these sensors built in, so biometrics are increasingly the smooth, everyday face of 2FA, particularly when combined with passkeys.
Hardware security keys
A physical key, such as a YubiKey, plugs into a USB port or connects wirelessly and confirms your identity with a tap. These keys support the FIDO2 standard and check that you are signing in to the genuine website, which makes them phishing-resistant. The NCSC considers this style of authentication the strongest generally available, and it is well suited to administrator accounts and anyone with elevated access to your transport systems.
Are SMS codes safe? SIM swapping explained
SMS-based 2FA is safer than a password alone, but it carries a specific weakness worth understanding. In a SIM swapping attack, a criminal persuades a mobile network to transfer your number to a SIM card they control, often by impersonating you with details gathered from social media or an earlier data breach. Once they hold your number, any verification codes sent by text arrive on their device instead of yours.
Text codes can also be captured by convincing fake login pages that harvest both your password and the code as you enter them. Neither risk means you should turn SMS 2FA off if it is your only option. It does mean that where an authenticator app, a passkey or a hardware key is offered, you should choose one of those instead. For any account that controls passenger data, funding or finances, moving away from text codes should be a priority.
Passkeys and passwordless authentication
The most significant change since two-factor authentication became mainstream is the arrival of passkeys. A passkey replaces your password entirely with a pair of cryptographic keys. A private key stays locked on your device and never leaves it, while the service keeps only a matching public key. When you sign in, your device proves it holds the private key after you unlock it with a fingerprint, face scan or PIN. There is no password to phish, steal or reuse.
Because a passkey is tied to the genuine website address, it cannot be used on a fake copycat site, which defeats most phishing outright. This is why the NCSC now recommends passkeys as the default sign-in method for consumers, describing them as both more secure and easier to use than passwords.
Adoption has moved quickly. The FIDO Alliance reported that around five billion passkeys were in use worldwide by World Passkey Day in May 2026, with three-quarters of people surveyed having enabled a passkey on at least one account. Apple, Google and Microsoft all support them, and Microsoft has made passkeys the default for new accounts. For most organisations, passwords will not vanish overnight, but the direction is clear, and it is worth enabling passkeys wherever your key services offer them.
How to set up two-factor authentication
Turning on 2FA is usually quick. The exact wording varies between services, but the steps are much the same everywhere.
- Open the security or account settings of the service you want to protect. The option may be called two-factor authentication, two-step verification or login verification.
- Choose your preferred second factor. An authenticator app or a passkey is a better choice than a text code where both are offered.
- Follow the on-screen prompts. For an authenticator app this usually means scanning a QR code, which links the app to your account.
- Confirm the setup by entering a code or approving a test prompt.
- Save your backup codes somewhere safe before you finish. This step is easy to skip and the one people most regret skipping.
Backup codes are single-use codes that let you get in if you lose access to your usual second factor. Store them somewhere separate from your phone, such as a password manager or a printed copy kept securely. The NCSC recommends starting with your most important accounts, which for a transport organisation means email, your transport management software, banking and any cloud storage holding passenger records. Email deserves special attention, because anyone who controls your inbox can reset the passwords on your other accounts.
Best practice for operators and organisations
If you are responsible for security across a scheme rather than just your own accounts, a few principles will help you get the most from 2FA.
- Prioritise phishing-resistant methods. The NCSC's updated guidance recommends choosing the strongest practical method, favouring passkeys and hardware keys over text codes, especially for administrator accounts.
- Offer a choice of second factors. Not every volunteer owns a modern smartphone or has a reliable signal, particularly in rural areas. Providing more than one option keeps everyone covered without weakening security.
- Do not over-prompt. Ask for the second factor when risk is higher, such as a new device or an unusual location, rather than on every login. Constant prompts push people towards insecure workarounds.
- Combine 2FA with staff awareness. Since phishing is the leading threat, brief training on spotting suspicious emails multiplies the value of your technical controls.
- Consider Cyber Essentials. The government-backed Cyber Essentials scheme expects organisations to apply MFA to their cloud services, and certification is increasingly requested in local authority and NHS contracts.
Choosing software that takes these decisions seriously matters too. Road XS is built on secure cloud infrastructure, and you can read more about our approach on the Road XS security page and in our note on how we strengthened our cloud infrastructure through a partnership with Google.
Common challenges and how to handle them
Two-factor authentication is not without friction, and a little planning avoids the usual headaches.
Lost, stolen or flat phones
If your phone holds your authenticator app and you lose it, you can be locked out. Backup codes are the answer, along with registering a second method such as a spare device or a hardware key. Set these up in advance rather than in a panic.
Volunteers without smartphones
Some drivers and coordinators may not own a smartphone or may be reluctant to use a personal device for work. You do not always need a mobile for 2FA. Some services accept a landline for voice codes, and hardware keys work without any phone at all.
2FA is strong, not invincible
Determined attackers still try to work around 2FA through convincing phishing pages and social engineering. That is why phishing-resistant methods like passkeys matter, and why 2FA should sit alongside good password hygiene and staff awareness rather than replacing them.
Frequently asked questions
What is two-factor authentication in simple terms?
It is a way of proving who you are using two separate checks instead of one. Typically that is your password plus a code from an app or a fingerprint, so that a stolen password on its own is not enough to get into your account.
What is the difference between two-factor and two-step verification?
Very little in everyday use. Two-factor authentication strictly means two different types of proof, while two-step verification means two steps in the sign-in. The NCSC treats the terms, along with multi-factor authentication, as describing the same protection.
Is two-factor authentication safe?
Yes, and it is one of the most effective steps you can take. Microsoft has estimated that MFA blocks more than 99 per cent of automated attempts to break into accounts. Authenticator apps, passkeys and hardware keys are safer than codes sent by text.
How do I set up two-factor authentication?
Go to the security settings of the account you want to protect, choose a second factor such as an authenticator app or passkey, follow the prompts to link it, and save your backup codes. Start with email, banking and your transport software.
Are passkeys better than two-factor authentication?
Passkeys are a modern, phishing-resistant replacement for the password itself, rather than an extra step on top of one. Because there is no password to steal, they remove a whole class of attacks. The NCSC recommends them as the default sign-in method for consumers where available.
Can two-factor authentication be hacked?
It is far harder to bypass than a password alone, but not impossible. SMS codes can be intercepted through SIM swapping, and sophisticated phishing can trick users into handing over a code. Choosing passkeys or hardware keys closes off most of these routes.
Secure transport software from Road XS
Strong authentication is only part of the picture. The software you use to manage bookings, drivers and passenger records should be built with security in mind from the ground up. Road XS combines two-factor authentication with secure cloud hosting, so community transport operators, dial-a-ride schemes and the charities behind them can protect sensitive passenger data without adding complexity for volunteers and coordinators.
If you are still relying on paper or spreadsheets, our guide on why paper and spreadsheets no longer work for transport management explains the risks, and the wider Road XS features show how a modern platform keeps your service both safer and simpler to run.
