Two factor authentication is extremely important for keeping your exchange accounts secure. Here is a breakdown of different 2FA methods, how they work, and how secure they are.

TLDR: 2FA using SMS is not secure. Use an authenticator app instead.

Two-factor authentication is an easy way to make your exchange account much more secure, by requiring a one-time passcode (OTP) on top of your email and password. The passcode is generated using the current time and a secret key known only by the OTP generator and the exchange. The exchange compares the code you entered to the one it generated to verify your identity. I highly recommend using 2FA, since email/passwords are not that hard to crack these days.

Here are 4 commonly used 2FA methods:

• Email (least secure): With this method, the OTP is generated and sent to your email. A would-be hacker already knows your email address (since they've already logged in to your exchange account), so the only thing protecting your coins is your email password. Hopefully it's not the same as your account password, since they know that too.
• SMS (slightly more secure): In this case, the OTP is texted to you. While slightly more secure than the email method, it's still vulnerable. The passcode can be stolen using SIM card "clones" or malware, or even just by stealing your phone.
• Authenticator apps (much more secure): This method is more secure because the OTP is generated on your device and never leaves it. In fact, because of how one-time passcodes are generated, you can use an air-gapped device (not connected to the internet) to generate the OTP. Of course, no method is completely safe: if the device is connected to the internet (your phone for example), malware could be used to steal your passcodes. Authenticator apps can be backed up using several methods. I don't recommend backing up to the cloud, because then your account is only as secure as your cloud storage is.
• Security keys (most secure): This method uses a USB key-like device to generate the OTP and quickly log you into your account. This is the most secure method, and is effectively the same as using an air-gapped device, but more convenient since the security key enters the OTP automatically. However, it's the only method that isn't free.

If you've made it this far, congrats! You now know all you need to about two factor authentication. If you're still using email or SMS 2FA, go ahead and download an authenticator app or buy a security key. One last piece of advice: set up your account to require 2FA every time you log in. Yes, every time. It's going to get annoying, but keeping your account protected is worth the extra 5 seconds.