How does 2FA protect a crypto account?

Two-factor authentication, or 2FA, protects a crypto account by asking for something besides your password before letting you in or letting money out. The second factor is usually a code from an app, a push prompt, a text message or a physical security key. A thief who has only your password, from a leak or a fake login page, is stopped at that second step.

How does a crypto 2FA authenticator app work?

When you turn on app-based 2FA, the exchange shows a QR code. Scanning it stores a secret key in your authenticator app. From then on, the app and the exchange both run the same calculation on that secret and the current time.

The method is set out in RFC 6238, an internet standard published in May 2011. It recommends a new code every 30 seconds. Because nothing is sent over the network, Coinbase notes that authenticator apps keep working without phone reception or internet once set up. Treat the QR code like a password.

Is SMS 2FA or an authenticator app safer?

An app is generally safer than text messages. Coinbase lists its options from strongest to weakest as security key, passkey, authenticator app, its own app prompt, and SMS last. It warns that SMS can leave you open to phone number porting attacks, where a criminal moves your number to their own SIM. That attack is explained in what a SIM swap attack is.

Coinbase ranks security keys first because their credentials are not stored on a networked device. Enabling one on Coinbase turns off the other methods. The wider set of account settings, including withdrawal allowlists, is covered in how to secure a crypto exchange account.

Why is my 2FA code not working?

The most common cause is the clock. RFC 6238 lets a server accept codes from a step or two either side of the current one, but a phone whose time has drifted further than that will fail. Kraken's fix is to set the phone's date and time to automatic instead of manual.

The second cause is using the wrong entry. Kraken lets users set separate 2FA for sign-in, funding, trading and its master key, and suggests labelling each one and deleting old entries after regenerating a code.

How do you reset 2FA on Crypto.com?

In the Crypto.com App, as of November 2026, go to Settings, then Security, then 2-Factor Authentication, and tap Reset 2FA. If you still have your old codes, you confirm with your passcode and a code. If you lost them, you enter your passcode and complete identity verification. Crypto.com says resetting app 2FA also changes Exchange 2FA, and that you should delete the old key from your authenticator.

For the Crypto.com Exchange without your authenticator, support asks for a short video showing your face and your registered ID. Crypto.com also says withdrawals may be disabled for 24 hours after 2FA is turned off. Use only the official help site or chat, since fake "2FA reset" pages are a known trick, as common crypto scams describes.