LogFAQs > #926179491

Yes, because it relies on the "something you know, something you are, and something you have" principle.

To spoof someone's identity and bypass two of those three factors is pretty hard so long as the back end is secure. Because even if you know someone's password ("something you know"), how will you get their phone/email account ("something you have") or a biometric measure ("something you are")?

Now it's not faultless. A 2FA based around a password and an email account can be compromised if someone can get into your email without much difficulty, hence the move to either using a single phone for authentication or, better, a biometric lockout.

Having a multi-factor authentication like a password combined with an fingerprint scanner/facial scanner that unlocks the authentication app on your phone actually fits all three, which is pretty much faultless. My Microsoft Authenticator app is set up like this (when you need an MFA token, you have to unlock the app using FaceID first to even view the MFA token). I just have to not lose my phone (which a bit of a pain in the ass when it's on the other side of the house but such is life; it's why I both despise and like MFA).
---

"Imagine a world where hypothetical situations didn't exist..."