An online bank uses several methods to keep customer accounts secure. (a) Explain how two-factor authentication (2FA) works. [3] (b) State two advantages of...

(a) How two-factor authentication (2FA) works [3]

Two-factor authentication requires the user to provide two different types of evidence (factors) to prove their identity before access is granted. [1]

The first factor is typically something the user knows, such as a password or PIN. [1]

The second factor comes from a different category: something the user has (e.g. a mobile phone that receives a one-time code via SMS or an authenticator app) or something the user is (e.g. a fingerprint or facial scan, which is a biometric). The key principle is that the two factors must come from different categories, so compromising one does not compromise both. [1]

(b) Two advantages of 2FA over a simple username and password [2]

1. Even if an attacker steals or guesses the user's password, they still cannot access the account without the second factor (e.g. possession of the user's phone). This dramatically reduces the success rate of password-based attacks. [1]
2. 2FA provides significantly stronger security than relying on a single method such as a password alone, because an attacker would need to compromise two independent systems rather than just one. [1]

(c) One type of automated verification used to prevent bots [2]

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart): a challenge that requires the user to identify objects in images, read distorted text, or complete a simple puzzle. [1] These tasks are designed to be easy for a human brain to solve but very difficult for automated software (bots), thereby preventing automated login attempts, account creation, or credential-stuffing attacks. [1]

(d) One disadvantage of 2FA for the user [1]

The user may not always have immediate access to their second authentication device (for example, their phone may be lost, broken, or out of battery), which could temporarily prevent them from logging in to their own account. [1]