What is 2FA and why crypto payouts need it

Two-factor authentication combines something you know (a password) with something you have (a phone app or hardware key). Even if an attacker steals your password through phishing or a data leak, they cannot log in or confirm a sensitive action without the second factor.

The most common type is TOTP, defined in RFC 6238 and used by apps such as Google Authenticator, Authy and many password managers. When you enable 2FA, the service shows a QR code containing a shared secret. The app then generates a new six-digit code every 30 seconds from that secret and the current time, without needing an internet connection. Hardware security keys offer even stronger protection against phishing.

SMS codes are better than nothing but weaker. Attackers can take over a phone number through a SIM swap, and messages can be intercepted. For crypto accounts, where stolen funds cannot be returned, an authenticator app or hardware key is strongly preferred.

In crypto services, 2FA protects two things: access to the account and withdrawals. Requiring a code for each payout means that a stolen session or API key alone is not enough to move money. Common mistakes are enabling 2FA but not saving backup codes, keeping the authenticator only on one phone without a recovery plan, and sharing one 2FA device among several team members.

In Moonvex, merchants should turn on 2FA right after signing up, and every payout must be confirmed with a 2FA code.