Secordit home
Contact

What is single-factor authentication?

Single-factor authentication means a service accepts only one type of check, most often a password, before it lets you in. A password alone can be guessed, reused, phished or stolen. MFA, 2SV or a passkey adds a further check. The MFA, 2SV and passkey pages cover those methods in more depth. 123

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. The service asks for one check, usually a password. 12
  2. If that password is guessed, reused, phished or stolen, the attacker may be able to sign in with nothing further to stop them. 31
  3. Some older or lower-risk services still only offer a password. The NCSC's 2SV guidance has a path for when 2SV is not available. Use a strong unique password, ideally via a password manager. Prefer services that offer a second step for important accounts. 1

How it can look

The NCSC's consumer guidance on 2SV says it helps even if a password is known. Its blog on MFA types says MFA still makes a big difference compared with relying solely on passwords. There is no general rule in those sources that a password-only account is illegal. 231

Warning signs

  • An important account, such as email or banking, still has only a password. The service does offer 2SV, MFA or a passkey, but it has not been turned on. 21
  • The same password is reused on a password-only site and on more important accounts. 1
  • A message claims that a password-only site is illegal in general. 1

What to do now

  1. Where a service offers MFA, 2SV or a passkey, turn it on, especially for email and banking. 21
  2. If 2SV is not available, use a strong unique password, ideally via a password manager. Prefer a service that offers a second step for important accounts. 1
  3. Read the MFA, password manager and passkey pages for the detail of those methods, rather than repeating it here. 21

UK reporting and support

  • If you think an account has been taken over, follow the NCSC help for a hacked account. 4
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 578
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 6
  • If someone is in danger, call 999. 78

How to protect yourself

  • Prefer services that offer a second step for important accounts, and turn that step on. 12
  • If you must use a password-only site, give it a unique password from a password manager, and do not reuse that password anywhere else. 1
  • Add a passkey or MFA as soon as the service offers it. 13

Frequently asked questions

If a website only asks for a password, does that mean it is unsafe to use?

It means the service is using single-factor authentication, most often a password alone. That password can be guessed, reused, phished or stolen. Use a strong unique password, and prefer a service that offers a second step for important accounts. 13

What should I do if 2SV is not available?

The NCSC's 2SV guidance says to use a strong unique password, ideally via a password manager. Prefer services that offer a second step for important accounts. 1

Is this the same as the MFA page?

No. This page explains password-only sign-in and points you to MFA, 2SV and passkeys. The MFA page covers those methods in more depth, including that not every method is equally strong. 23

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Setting up 2-Step Verification (2SV) | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, Turn on 2-step verification (2SV) | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Not all types of MFA are created equal | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  5. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  6. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  7. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  8. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).