Which of the Following Is an Example of Two-Factor Authentication?
Two-factor authentication combines two different factor types — for example, a password (something you know) plus a one-time code from your phone (something you have), or an ATM card (have) plus a PIN (know). Using two of the same factor, such as a password and a security question, is not 2FA.
The answer
An example of two-factor authentication (2FA) is any login that requires two different categories of proof. Classic examples:
- A password (something you know) plus a one-time code texted or generated on your phone (something you have).
- An ATM card (something you have) plus a PIN (something you know).
- A password (something you know) plus a fingerprint (something you are).
The defining rule is that the two factors must come from two different factor types. Requiring two things from the same category — like a password and a security question (both 'something you know') — is not two-factor authentication.
The three authentication factors
All authentication factors fall into three categories:
- Something you know — a password, PIN, passphrase, or security-question answer.
- Something you have — a phone receiving a code, an authenticator app, a hardware token, a smart card, or an ATM card.
- Something you are — a biometric such as a fingerprint, face scan, or iris scan.
True 2FA pulls from two of these three categories. This is what makes it stronger than a password alone: an attacker who steals your password still cannot log in without also possessing your phone or your fingerprint.
Why the common wrong answers fail
- Password + security question. Both are 'something you know.' Since they share a category, this is single-factor authentication with two steps, not 2FA. An attacker who researches you may guess both.
- Two passwords. Same category again — still one factor.
- Fingerprint + face scan. Both are 'something you are.' Two biometrics is still a single factor type, so it is not 2FA (it is sometimes called two-step biometric verification, but not two-factor).
- An ATM withdrawal (card + PIN). This is valid 2FA — the card is 'something you have' and the PIN is 'something you know' — so it is a correct example, not a distractor.
The test for any option: identify the category of each element. If the two elements come from two different categories, it qualifies as 2FA. If they share a category, it does not.
2FA vs. MFA, and the most secure form
Multi-factor authentication (MFA) is the umbrella term for using two or more factors. 2FA is simply MFA with exactly two factors — every 2FA setup is MFA, but MFA can also use three factors.
Among 2FA methods, security varies. SMS text codes are the weakest common form because texts can be intercepted or SIM-swapped. Authenticator apps (TOTP codes) are stronger. The most secure widely available option is a hardware security key using the FIDO2/WebAuthn standard, which resists phishing because it cryptographically verifies the website before responding. So while any 2FA beats a password alone, a hardware key is generally considered the most secure second factor.
| Password + code from phone app | Know | Have | Yes |
| ATM card + PIN | Have | Know | Yes |
| Password + fingerprint | Know | Are | Yes |
| Password + security question | Know | Know | No — same factor type |
| Two passwords | Know | Know | No — same factor type |
| Fingerprint + face scan | Are | Are | No — same factor type |
Frequently asked
What are the three authentication factors?
The three factors are something you know (password, PIN), something you have (phone, security token, ATM card), and something you are (biometrics like a fingerprint or face scan). Two-factor authentication combines two of these three categories.
Is a password and security question two-factor authentication?
No. Both a password and a security-question answer are 'something you know,' so they belong to the same factor category. Two-factor authentication requires two different factor types, so this is single-factor authentication with two steps.
What is the difference between 2FA and MFA?
MFA (multi-factor authentication) is the umbrella term for using two or more factors. 2FA is MFA with exactly two factors. Every 2FA setup is a form of MFA, but MFA can also require three factors for higher security.
Is an ATM withdrawal an example of two-factor authentication?
Yes. An ATM withdrawal requires the card (something you have) and the PIN (something you know), which are two different factor types. That combination makes it a classic real-world example of two-factor authentication.
What is the most secure form of 2FA?
A hardware security key using the FIDO2/WebAuthn standard is generally the most secure, because it resists phishing by verifying the website cryptographically. Authenticator apps are stronger than SMS text codes, which are the weakest common form due to interception and SIM-swap risks.