Two-Factor Authentication Statistics: A Good Password is Not Enough

Bojan Jovanovic

Updated: July 14, 2023

SHARE:

Cyberattacks have become common in recent years. That’s why stronger passwords are needed to protect our personal information online. But even with passwords, we are still at risk of being hacked.

This is where two-factor authentication comes in to save the day, as it adds a second layer of security that protects your info. A two-factor authentication app protects you by making it difficult for hackers to access your online accounts.

If you want to avoid your online accounts and information being tampered with, read on to find out the latest two-factor authentication statistics and learn how to protect your accounts better.

Two-Factor Authentication Statistics (Editor’s Picks)

• Hackers probe more than 20 million Microsoft accounts every day.
• An average employee has to remember 191 passwords.
• 5% of internet users are fooled by phishing emails.
• Phishing emails are successful 47% of the time.
• 1% of security breaches are due to weak or stolen passwords.
• Over 80% of mobile devices have biometric security enabled.
• 19% of government agencies use hardware authentication tokens.
• Only 62% of companies use multi-factor authentication.
• China and Russia are the most commonly blocked countries in authenticator apps.

What is Two-Factor Authentication?

Two-Factor Authentication is an additional password you must enter before accessing your account. Many services and websites offer an extra security layer as an optional addition to their standard login process.

The way 2-factor authentication works are pretty straightforward:

• Each login attempt to an online service requires verification by the account owner.

• The process is completed by inputting an additional code sent to you or clicking a notification. Once the login is confirmed, the login attempt is authorized.

• The details of the process may vary, but the idea is the same – it’s a second layer of security that, even in the case of password theft or data breach, can keep unauthorized users out of your account.

• The setup is usually completed in a few clicks. You must select “dual-factor authentication” from the website’s menu and confirm the method you wish to use later to verify your identity. Services can even “remember” the machine you’re logging in from, so the process needs to be repeated only if you access the account from a different device or location.

Types of Multi-Factor Authentication

Depending on the service and computer system, authentication doesn’t always work the same way. There are multiple ways to use multi-factor authentication, some of which involve a separate offline device. Some methods are more complicated, and two-factor authentication requirements might differ depending on your method.

Here are the current types of multi-factor authentication:

1. Push notification: You install an authenticator app on a device that sends you a notification whenever login attempts occur. The app sends your response to the server, allowing or denying access to the service. 
   The services themselves usually make these apps and often show the IP address or estimated location of the person attempting to log in to the account. Push notifications are the fastest and easiest to use but require an internet connection. The latest two-factor authentication statistics show this is the most common method.

2. One-time password: This is usually a six-digit code generated via an app. The code can be created when you log in, or the app constantly swaps new codes in sync with the internal server clock. These apps work offline and are fast to set up. The only downside is that you need to type in the code manually.

3. Email/SMS code: This is similar to the OTP method, but the code is sent to your email address or as a text message to your phone. Sometimes, an email message can include a one-click-login link that skips the whole username and password ordeal. Email is being phased out as an authentication method since it can be easily hacked.

4. Two-factor token: This physical device works entirely offline, and it is one of the most secure methods of multi-factor authentication since the hacker would need to steal it from their target to gain access. Tokens can generate one-time passwords or work as USB keys that unlock access to their registered account upon connecting to the computer.

5. Biometrics: This method is relatively new and has limited use in other ways. Biometrics include fingerprints and vocal and facial recognition, and they are considered the most difficult to crack. Setting up biometric verification is a long process involving additional apps and scans before they can use it.

Multi-Factor Authentication Benefits

Why do you need multi-factor authentication? There are several reasons – some more obvious than others – but in general, it is a way to improve security and usability without hindering any features of the service you are trying to access.

Here are some key benefits:

1. Security is the most obvious benefit of using two-factor or multi-factor authentication. The more difficult it is to steal an account, the more secure it is. Two passwords mean twice the work for the attackers. Simple.

2. Ease of access is another great reason to use two-factor authentication. Accessibility and reducing stress from remembering dozens of passwords is another key benefit. Some experts believe this can, in particular business environments, even reduce operational costs and increase productivity.

3. The final critical factor is compliance with specific standards inside an organization. A company with a uniform login system is less prone to security mishaps.

Two-Factor Authentication Software

You don’t need to be a skilled hacker or a corporate user to get access to the most popular 2FA software on the market. Most of the best apps are entirely free.

Currently, there are many authenticator apps on the market. Most of them are designed for smartphones running on Android and iOS, but a few are designed exclusively for PCs. We’ll review the most popular ones and describe how to set up 2FA.

Google Authenticator

Google Authenticator is the most commonly used authenticator app. Like other apps of this caliber, this one works with almost every service and website offering 2FA. That includes Facebook, Dropbox, some video games, and Google services like Gmail.

This is a straightforward, easy-to-use app. Once you download it on your iPhone or Android device, just enable two-factor authentication on your service, scan the QR code, or enter a verification code if the service doesn’t provide QR codes. The codes should immediately start generating for that service, and most of the websites will ask you to input the code on your screen.

LastPass Authenticator

When an app is advertised as “the only authenticator app you’ll ever need,” one tends to be skeptical. Luckily, LastPass works just like advertised, even without requiring the user to input any codes. Unlike Google’s two-step verification, this app works magic via push notifications. When you log in to a connected service, you’ll receive a notification on your phone to confirm or deny the login attempt. It’s convenient for detecting service breaches, too.

The setup could be faster, though. You will need a LastPass account and a browser extension to connect your desktop LastPass app with the browser and enable one-tap login for the supported services. After everything is up and running, you only have to log in by tapping a button on your smartphone.

Microsoft Authenticator

Microsoft also has its two-step authenticator app. It works on Android, iOS, and Windows 10 (desktop and mobile) and combines the features of Google and LastPass authenticators into a multi-authentication app.

The setup for most services and websites works exactly like with any similar app – you enable dual-factor, scan a QR code, enter a verification key, and go off. If you have a Microsoft account, you can enable one-tap notifications and skip entering codes altogether. Visually, it’s very similar to Google’s app, with a small addition of timers showing exactly how many seconds remain until a code changes.

Dual-Factor Authentication for Gamers

Since the online gaming boom, hackers have searched for unprotected gaming accounts to snatch and resell for a quick buck.

World of Warcraft accounts has always been the hottest commodity on the black market since some could be worth hundreds or thousands of dollars. Blizzard, the game developer, created a fully offline multifactor authentication device that generated codes for a two-step login. 

This device had a unique code you needed to enter to connect to your Blizzard account. The device’s internal clock matched the clock on Blizzard’s server, thus enabling the gamers to log in safely to their accounts. This was later replaced by a free mobile app offering eight-digit codes and one-tap notifications.

Another popular platform, Steam, has its authenticator app. Steam is the world’s biggest store for digital PC games, offering tens of thousands of video games for millions of users. Therefore, a secure login system needs to be in place. The solution was two-fold and wholly integrated into Steam’s mobile app, allowing for game purchasing and connecting with your gamer friends. 

Steam Guard is the first building block, a code generator that creates shortcodes from both letters and numbers but afterward sets the computer as “known,” so the user doesn’t need to retype their password. Mobile confirmation triggers the second safety if you lose your account. Without completing this second confirmation, some features of the platform are blocked. Steam Guard codes need to be entered every single time you make a purchase, so there’s no possibility for a hacker to empty your wallet through Steam.

Two-Factor Authentication Statistics for 2023

Two-factor authentication adds a second layer of security that protects your info, thus making it difficult for hackers to access your online accounts and saving you lots of trouble from your online accounts and information being tampered with. 

Here are the current statistics on Two-Factor Authentication you need to know for your device security.

1. With 68% use, mobile push notifications are the most common authentication method.

(Duo Security, Abdalslam)

The most popular multi-factor authentication solutions in 2019 were push notifications, with phone calls ranking the highest. SMS passcodes continue to be substantially declining, especially with the rise of SIM swapping, which is already causing problems for people using their phone numbers to authenticate. More people use hardware tokens than one-time-use codes sent as text messages.

2. 19% of government agencies use hardware authentication tokens.

(Duo Security, Abdalslam)

Industries rarely use the hardware two-factor token as their preferred method of account protection. However, the federal government will most likely incorporate devices into its MFA security plan. After all, these organizations operate with the country’s most sensitive data, so there’s never enough security for them. 

Among other industries, only the financial sector has reported using hardware tokens, but even this usage is only 4%. Banks with two-factor authentication are least likely to use phone calls for their security, preferring passcodes and push notifications.

3. Only 62% of companies use multi-factor authentication.

(Zippia)

Cyber solid security, unfortunately, isn’t high up on the list of priorities for many companies in the United States. The most recent usage statistics for two-factor authentication show a low number of small and large businesses using multi-factor authentication tools since companies are now more likely to be targeted by cybercriminals, every layer of additional protection matters.

4. Over 80% of mobile devices have biometric security enabled.

(Source Security, Biometric Update)

Every time you unlock your phone with your fingerprint, you use its biometric security function. Experts believe we’re headed towards a passwordless future, where we won’t have to type in any codes, but instead, we will just use our fingerprints, retinas, or even our voices to confirm our identity. Some of these tools are already available on our smartphones – Face ID, Touch ID, Android fingerprint, Windows Hello, etc. For now, though, your password is still what matters most.

5. 61% of people use the same password on multiple services.

(LastPass) 

One of the rules for good account security is never to reuse a password. That way, you can prevent losing another account if one of the services suffers a security breach. Hackers, more often than not, will try to use your login credentials on popular platforms, trying to steal even more data this way. Unfortunately, most people have reported they don’t rely on various passwords; instead, they use the same one multiple times.

6. 81% of security breaches are due to weak or stolen passwords.

(LastPass)

Which passwords are considered weak? A password is weak if it includes repeating letters and/or numbers, sequences, or common phrases such as: “admin,” “I love you,” and “password.” Security reports gathered from breaches revealed that internet users don’t think too hard when creating a secure password. Therefore, once that login is stolen, it’s easy for hackers to grab even more in one fell swoop.

7. Phishing emails are successful 47% of the time.

(Duo Security)

An average internet user might be savvier today than a few years ago. But, without secondary authentication, he is still likely to fall victim to a phishing attack. In a test run by Duo Security, from more than 4,000 phishing campaigns, nearly half of them captured at least one set of credentials. 

While this may sound like a disappointing result, it shows significant improvement. In 2017, the same test had a 65% success rate, so a drop in this sign shows that users are getting better at distinguishing fake emails from legitimate ones.

8. 5% of internet users are fooled by phishing emails.

(Duo Security)

The same experiment by Duo Security revealed some interesting facts about user behavior when they receive a phishing email. One in three recipients, for example, will open the email, while 17% of recipients click on the phishing link embedded in the body of the message. But, only a handful of people have entered their account information, showing a significant improvement year-on-year.

9. An average employee has to remember 191 passwords.

(LastPass)

We already have a lot on our minds while we’re at work. Overwhelming your employees with a truckload of passwords does not lead to a more productive or secure environment. Researchers have found out that, in companies with 250 employees, a staggering 47 thousand passwords are in constant use. 

That’s why more and more businesses rely on password-keeping apps that can also generate more secure passwords for their employees without relying on humans to create their passwords inevitably get cracked.

10. Google’s authenticator can protect an account from up to 100% of automated attacks.

(Google)

Both Google and Microsoft’s multi-factor authentication statistics paint a clear picture – setting up a multi-factor authentication pretty much nullifies the chances of getting your account hacked. Since hackers do not have access to the device the authenticator app is installed on, they cannot complete the login process even if they somehow get ahold of your username and password. That being said, you still need to remain vigilant for account takeover fraud, as more sophisticated targeted attacks can, under certain conditions, penetrate this line of defense.

11. In authenticator apps, China and Russia are the most commonly blocked countries.

(Duo Security)

One of the essential tools in the authentication toolset is blocking logins from specific locations and preventing account takeover. If you know that you’ll never travel to a particular country or don’t have anyone from China or Russia logging into your shared system, you’ll want to put those countries on the automatic block list. This year, 3 million authentications were blocked in this vain, with the United States, India, and France also appearing in the top five blocked countries by users of two-factor authenticators.

12. Hackers probe more than 20 million Microsoft accounts every day.

(Microsoft)

Probing, or trying out passwords from a breached database, is the most common method of account theft. Whether a password is secure doesn’t matter; hackers usually just purchase a list and try each password on popular services. Microsoft recorded millions of probes daily, confirming that two-factor authentication is required now for accounts on the most popular services.

Conclusion

Having passwords won’t save your online accounts from being hacked, as passwords are insufficient to protect your online accounts. Additionally, most internet users use only one password for all their online accounts, which puts them at risk as hackers easily hack their accounts and tamper with valuable information.

Adding two-factor authentication provides an extra layer of security for your information. This measure increases your protection against cyber attacks like hacking and identity theft.