Having a long and complex password is a great strategy for thwarting would-be hackers looking to grab your accounts or personal information. Two-Factor Authentication (“2FA”) is an extra step you can take to make your accounts even more secure. Three main factors can be used to authenticate your identity:

• Something you know like a password
• Something you have in your possession like a badge or cell phone
• Something you are like your fingerprint

2FA utilizes using two of these factors in order for you to login to your account. A popular (and typically convenient) method of 2FA utilizes a password and a text message to your phone with a code that must be input before accessing your account. While this method is on average more secure than just using a password, hackers still have ways of getting that text code, either by SMS exploits or through social engineering.

How can a hacker intercept the 2FA text message?

All they need is your phone number. Once they have your password, they can attempt to login to the website or service. The site will then send the text verification, but by this point the hacker has rerouted text messages to the mobile phone in their possession, giving them full access to the website.

Social Engineering

The other method a hacker can use to get your verification code is through social engineering. Social engineering is the use of manipulation and deception to trick victims into giving up personal or confidential information. In this instance, a hacker may attempt to convince the victim that there is suspicious activity on their account and to verify the number that was just texted to them. That number, however, is just what the hacker needs to finish getting into the account. What may appear like a legitimate call, email, or message is actually the hacker manipulating the victim.

How can you combat these strategies?

The first step is to use something other than text messages as your 2FA verification. An authenticator app, like Google Authenticator, is a relatively easy to use app that supplies your verification codes, and since these codes change every 10 to 15 seconds, they are harder for hackers to acquire. There are even more sophisticated 2FA methods available, but you should consider using the method that is going to work best for you.

The second step is to be aware of the social engineering tactics hackers may use to convince you to give up personal or confidential information. Visit the Security page of Astra Bank’s Security Center to learn more about common scams and to see some general safety tips to keep you and your loved ones safe from hackers.