3FA (Three-Factor Authentication) — is an account security method that requires users to verify their identity in three different ways to log in. Typically, these are a password, a code from a phone, and a fingerprint or facial recognition. Even if a scammer obtains the password and steals the phone, they won't be able to access the account without passing the third verification step.
3FA — is the next level of security after two-factor authentication (2FA), which requires two verification factors.
What counts as an authentication factor
A factor — is not just another code, but a separate type of verification. There are three types:
-
something you know — a password, PIN code or answer to a security question;
-
something you have — a phone with an authenticator app, a SIM card for receiving SMS codes or a physical security key;
-
something you are — a fingerprint, face or voice.
Three-factor authentication uses all three types at once.
This leads to a common mistake: an SMS code and a code from an authenticator app — are not two different factors. Both belong to the «something you have» category because both are received on a phone. A password plus these two codes — is still two-factor authentication, just with an extra step.
Where 3FA is used
Three-factor authentication is used where the consequences of an account breach are particularly serious:
-
in banking apps, for example, when making large transfers;
-
on cryptocurrency exchanges and in crypto wallets — when withdrawing funds;
-
in corporate systems with access to sensitive data;
-
at facilities with restricted access, where a security pass, PIN code and fingerprint are checked.
3FA is rarely used on regular websites and social networks because each login would take too much time.
3FA in traffic arbitrage
Affiliate marketers mainly encounter three-factor authentication on platforms where they store and withdraw money, such as cryptocurrency exchanges and payment services. When logging in from a new device or withdrawing a large amount, they may be asked to provide a password, a code from an authenticator app and facial verification.
Important: if an account is protected by facial or fingerprint verification, it cannot be transferred to another person. That's why accounts with 3FA are not bought or sold, and when working in a team, each member creates their own account.
