Two-factor authentication compared: SMS, apps and passkeys

Every Indian internet user knows the OTP ritual: enter a password, wait for a six-digit SMS, type it in. It feels secure, and it is certainly better than a password alone. But SMS is just one of several two-factor authentication methods, and it is not the strongest. If you are choosing what your website or customer portal should offer, or deciding how to protect your own accounts, the differences matter.

Here is how each method works, what it defends against, and where it falls short.

What “two factors” really means

Authentication factors fall into three groups: something you know (a password or PIN), something you have (a phone or security key) and something you are (a fingerprint or face). Two-factor authentication combines two different groups, so a stolen password alone does not open the account.

Two passwords, or a password plus a security question, is not true two-factor, because both are things you know and both can be phished or guessed the same way.

SMS one-time passwords

How it works

After the password check, the site sends a short numeric code to the registered mobile number. The user types it in within a few minutes.

Strengths

• Works on any phone, including basic feature phones.
• No app installation, so adoption is easy for customers.
• Familiar to users from banking and UPI flows.

Weaknesses

• SIM-swap fraud: a criminal persuades or deceives a mobile operator into issuing a replacement SIM for the victim’s number, and receives their codes.
• Phishing: a fake login page can ask for the OTP and pass it to the real site in real time.
• Social engineering: callers posing as bank or delivery staff talk people into reading codes aloud.
• Delivery problems: codes arrive late on congested networks or not at all when roaming, and SMS gateways cost money per message.

SMS OTP remains a reasonable baseline for low-risk customer accounts, but it is a weak choice for administrator access.

Authenticator apps (TOTP)

How it works

The user scans a QR code once with an app such as Google Authenticator, Microsoft Authenticator or a password manager that supports one-time codes. The app and the website share a secret and both generate a new code every 30 seconds based on the current time, following the TOTP standard.

Strengths

• Not tied to a phone number, so SIM-swap does not help an attacker.
• Works offline, which helps in areas with patchy signal.
• Free for the website to operate, with no per-message fees.

Weaknesses

• Still phishable: a convincing fake page can collect the current code and use it immediately.
• Losing or resetting the phone without a backup locks the user out.
• Setup is a small hurdle for less technical users.

Push notification approvals

Some services send an “Is this you signing in?” prompt to a trusted app. It is convenient, but it invites push fatigue: an attacker with the password triggers prompts repeatedly until the tired user taps Approve. Better implementations show a number on the login screen that the user must match or type in the app, and include location details, which makes blind approval less likely.

Hardware security keys

A small USB, NFC or Bluetooth device based on the FIDO2 and WebAuthn standards. When signing in, the user touches the key. The key checks which website is asking and only responds to the genuine domain.

This origin check is the big advantage: security keys are phishing-resistant. A lookalike domain cannot get a valid response. The trade-offs are the cost of buying keys, the need for a backup key, and some friction on phones without NFC or a suitable port. Keys are an excellent fit for owners, developers and anyone with hosting or domain access.

Passkeys

Passkeys use the same WebAuthn technology as security keys, but the credential lives on the user’s phone or computer, or syncs through their platform account (for example, Google Password Manager or iCloud Keychain). Unlocking with a fingerprint, face or device PIN completes the sign-in.

Why passkeys stand out

1. Phishing-resistant, because they are bound to the website’s domain.
2. Nothing for the user to type or remember, so conversions often suffer less than with codes.
3. No shared secret stored on your server that attackers could steal and reuse; the site keeps only a public key.

What to plan for

Support varies across older devices and browsers, users switching between ecosystems may need to create a passkey on each, and account recovery still needs a safe fallback. Many sites offer passkeys alongside another method during the transition.

Recovery codes: the part everyone forgets

Every second factor can be lost. Phones break, get stolen or are replaced. Good 2FA setups issue a set of single-use recovery codes when the user enrols, typically eight to ten, which they store somewhere safe such as a password manager or a printed sheet kept securely.

For website owners, recovery is also where attackers look for weakness. If support staff will switch off 2FA after a phone call, the whole scheme is only as strong as that call. Define a verification process and log every manual reset.

Which method should your website offer?

A practical approach for most Indian business sites and portals:

• Customers on a store or service portal: SMS or email OTP as a familiar default, with passkeys offered as an option where your platform supports them.
• Staff and editors: authenticator app at minimum, with recovery codes issued at setup.
• Administrators, developers and anyone with hosting, domain or payment access: passkeys or hardware security keys, with a registered backup.

For your own business accounts, turn on the strongest method each service offers, starting with email, domain registrar and hosting.

Adding app-based 2FA or passkeys to a custom portal is a well-understood piece of work. Our software development team can scope it, or you can ask an expert which method suits your users.

Frequently asked questions

Is SMS OTP better than no two-factor authentication?

Yes. It blocks most attacks that rely only on stolen or reused passwords. It is weaker against SIM-swap and phishing, so stronger methods are advisable for high-value accounts.

Are passkeys the same as two-factor authentication?

A passkey combines possession of the device with a local unlock such as a fingerprint or PIN, so it provides multi-factor protection in a single step and can replace the password entirely.

What should I do if I lose the phone with my authenticator app?

Use one of your saved recovery codes to sign in, then set up the authenticator again on a new device and generate fresh recovery codes.

Can authenticator app codes be phished?

Yes. A fake login page can capture a code and use it within its short validity window. Passkeys and hardware security keys resist this because they verify the real domain.