What the research found
A study published in 2026 tracked what happened when three major Canadian banks rolled out two-factor authentication (2FA) — the extra login step beyond just a password — during 2021–2022. Two banks made it optional. One made it mandatory. Researchers then analyzed cyber threat intelligence from criminal marketplaces to see which accounts were actually showing up as compromised.
The result was clear: mandatory 2FA significantly reduced the number of compromised accounts. Optional 2FA did not — even though it was available to everyone. Having the option to be safer wasn’t enough; only requiring it moved the needle.
This tracks with what large platforms report from their own systems: Microsoft has stated that MFA blocks over 99.9% of automated account-compromise attempts, and Google’s research shows that adding even a simple recovery phone number can block the vast majority of bulk phishing and bot-driven attacks.
Why this matters for you personally
The lesson isn’t really about banks — it’s about human behavior. If 2FA is sitting there as an optional toggle in your settings, the research suggests most people simply never turn it on, even when they know it helps. The fix isn’t more awareness; it’s making the safer choice the default in your own digital life, right now, rather than waiting for “someday.”
Practical steps, in order of effectiveness:
Turn on 2FA for your email first — it’s the recovery key to everything else.
Prefer an authenticator app or a physical security key over SMS codes, which can be intercepted via SIM-swapping.
Do this for your bank and any account tied to money before anything else.
2FA isn’t perfect — SMS-based codes have known weaknesses, and no single measure eliminates risk. Treat it as a strong first layer, not a complete solution.
Reference
Kamar, E., Howell, C. J., Maimon, D., & Fraser, I. “Evaluating the Effectiveness of Two-Factor Authentication (2FA) in Mitigating Account Takeover Fraud: A Natural Experimental Study on Canadian Banks.” (2026). https://doi.org/10.1177/00111287261441235
Top comments (0)