Definition
Two-factor authentication (2FA) requires two different kinds of proof to sign in or approve an action: typically something you know (a password) plus something you have (a phone receiving a one-time code, an authenticator app or a security key).
The three factor types are knowledge (password, PIN), possession (phone, hardware key, app) and inherence (fingerprint, face). Two checks of the same type, such as a password plus a security question, are not true 2FA. Multi-factor authentication (MFA) is the general term for two or more factors.
Messaging OTPs are the most widely deployed possession factor because they need no app install. They are weaker than app-based or phishing-resistant methods: SIM-swap attacks, phishing pages that relay codes in real time and interception all exist. NIST SP 800-63B treats OTPs sent over the public telephone network (SMS or voice) as a "restricted" authenticator and asks verifiers to consider signals such as SIM change or number porting before using them.
For consumer services in the GCC and MENA, SMS and WhatsApp OTP remain the practical default for sign-up, login and payment approval; banks and payment providers often apply stricter rules set by their central bank or regulator. Offer a stronger option (authenticator app or passkey) for high-risk actions.
Design tips: send the second factor only after the password is correct, bind codes to a single session and action, and explain in the message what the code is for ("to approve a transfer of AED 500").