2FA (Two-Factor Authentication)

Two-factor authentication (2FA) adds a second security factor to the classic password login, usually a short-lived code delivered through a separate channel such as WhatsApp, SMS or an authenticator app. It makes account takeovers far harder, because a stolen password alone is no longer enough.

What is 2FA?

Two-factor authentication (2FA) is a login method in which a user has to prove their identity with two different factors before getting access. It is the most common form of multi-factor authentication (MFA). The factors come from three categories:

• Something you know: a password or PIN
• Something you have: a phone, a hardware security key or an authenticator app
• Something you are: a fingerprint or face scan

The point is that an attacker who has stolen or guessed a password still cannot log in without the second factor. Security agencies such as the UK National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA) recommend 2FA for online accounts. In some sectors it is also a legal requirement: under the EU’s Payment Services Directive (PSD2), electronic payments generally need strong customer authentication, and the UK kept the same rules after Brexit.

2FA methods compared

• SMS code: a one-time password sent by text message. Works on every phone, no app needed. Weakness: SIM swapping, where criminals take over a phone number.
• WhatsApp code: a one-time password sent via a WhatsApp authentication template, often with a copy-code or one-tap button. WhatsApp encrypts messages and is tied to the device, which makes it harder to intercept than SMS. It requires the user to have WhatsApp.
• Email code or link: simple and cheap, but only as secure as the email account itself.
• Authenticator app (TOTP): the app generates a new code every 30 seconds, offline. No delivery cost and no interception in transit, but users must install and set it up.
• Hardware key or passkey: a physical key or a device-bound passkey based on public-key cryptography. Resistant to phishing, but more effort to roll out.

What 2FA costs per code (2026)

For apps and authenticator keys there is no per-code cost. For codes sent by message, two parts add up: the network or Meta rate for the market, plus SendSeven’s fee for every outbound message. Since 1 October 2026, Meta charges for every outbound WhatsApp message; authentication messages are billed at the market’s authentication rate. Typical all-in prices per code, net, ranging from the API Only rate to the Basic plan beyond its included messages:

In every market in this comparison, a WhatsApp code costs less than an SMS code. Worked examples by volume are in 2FA cost 2026: SMS vs. WhatsApp; the full WhatsApp rate card is explained in WhatsApp Business API pricing 2026.

How secure is each method?

Any second factor is much better than none. But the methods differ. The US standard NIST SP 800-63-4 (August 2025) still classifies SMS and voice codes as a “restricted” authenticator: allowed, but with known risks such as SIM swapping and interception, so organisations should offer alternatives. WhatsApp codes avoid the open SMS network and are tied to the WhatsApp account on the device. Authenticator apps never send the code over a network, and hardware keys and passkeys are the only common methods that also resist real-time phishing.

A short ranking from more to less secure: hardware key or passkey, authenticator app, WhatsApp code, SMS code, email code.

Best practice: a hybrid 2FA strategy

• WhatsApp first, SMS as fallback: send the code via WhatsApp and fall back to SMS if the number is not on WhatsApp or the message is not delivered. See SMS fallback.
• Stronger factors for high-risk accounts: admins, finance and anyone with access to sensitive data should use an authenticator app or a hardware key.
• Backup codes: give users one-time recovery codes in case they lose their phone.
• Short validity and single use: codes should expire within minutes and work only once.
• Rate limits: lock or slow down after a few failed attempts.
• Clear wording: tell users never to share the code, not even with your support team.

2FA with SendSeven

SendSeven lets you send 2FA codes over WhatsApp, SMS and email through one REST API, using WhatsApp authentication templates with copy-code buttons. On the Professional plan and above, the Flow Builder lets you set up the WhatsApp-to-SMS fallback without code. Delivery status comes back via webhooks.

The platform is hosted in the EU (Frankfurt), encrypted in transit and at rest, and a DPA under Article 28 GDPR is available. On pricing: Meta’s authentication rate applies to every WhatsApp code, and SendSeven charges a fixed fee per outbound message on top, never a percentage. All plans are on the pricing page.