Our application (investment solution) asks users to set up a 2FA method after setting their password during onboarding.

We offer multiple methods of 2FA; memorable questions, text message security, authenticator app (Google Authenticator, Authy, etc.) and our own mobile app.

Our average demographic is investment professionals over 40.

I’ve been trying to find out what the best default 2FA method to offer is during the onboarding process. I have recommended text message security as the default as it’s the most widely used and understood, with the option for the user to choose an alternate method from our available options if they want to.

However our tech team wants to use an authenticator app as the default as it cuts down on SMS costs—which I have conveyed may confuse our demographic as it’s much less widely used, even though it may be more secure when active.

Does any one have any opinion or data to back up a decision here? Should one be defaulted to over the other? Or should we just give the user the choice to begin with (my concern here being we’re increasing cognitive overload)?

Thank you.

2 Answers 2


With the wide availability of authentication methods (you even mention several of them), defaulting to one is a lottery, and a default will come only after studying your user base.

It's true that the one you say is the most common and arguably the best, but if your user base is one of sophisticated users, they may already have some authentication app. Bottom line: it depends on user testing.

2FA authentication methods aren't necessarily recognized as a security step by many users, but an annoyance (I'm writing a paper on it). The level of cognitive load in any 2FA method is always high. As a matter of fact, high is the baseline, from there it could go to very high, extremely high, and close to impossible.

So, with this being said: if possible, I'd offer users a menu of options to choose from and give them the opportunity to exercise their locus of control. It will reduce friction, make things easier, and security will be the same. In terms of cognitive load, they know they will have to pass through a security process, so letting them choose which one is less costly in terms of friction is always the best path.

As for the SMS argument, the cost is negligible; we use them a lot, so I'm quite aware of their costs. One thing is to send 100 SMS per day to each user, or even 1 SMS every day. Another thing is to send one SMS one time, or every now and then.


Some users, especially those over 40, may not be as familiar with authenticator apps, potentially leading to confusion.But, again this is subjective. So, doing a bit of Microsurvey would come handy.

Another thing is - Users might need to download a third-party app, which adds an extra step and gets them off the current experience.

So, basically weigh in on - familiarity, security, Effort and cost considerations

If a person is familiar with a process he might make the EFFORT. However, if a user is not familiar he will not be willing to put in a lot of EFFORT. For example, 2FA required for Saas. The user might have to search his mobile phone and then check the code and then type the code as well. Users may not have immediate access to their phones for receiving text messages.

My Recommendations:

User Choice: Provide users with the option to choose their preferred 2FA method during onboarding. This balances security with user preference.

Educational Resources: Offer clear and concise explanations of each 2FA method, highlighting the benefits and potential risks. This helps users make informed decisions.

Default with Education: Default to the method that strikes a balance between security and user familiarity, but accompany it with educational resources. This allows users to change their default if they wish.

The other day I was setting up ADs for Linkedin that required 2FA. See how nicely they strike a balance between security and familiarity by explaining about 2FA and How is it used with an option to learn more. 👇👇👇👇👇👇

enter image description here

Default Account Authentication

When you first create your account, 2FA is disabled, but DigitalOcean takes other steps to protect your account.

Each time you log in from a new location using a new device or a different web browser, we email an authorization code to the address linked to your account. You’ll need to check your email, retrieve the code, and enter it to complete your login.

This means that even without 2FA enabled, a bad actor would need both your DigitalOcean password and your email password to log in. This isn’t as effective as 2FA, but it increases the difficulty for would-be attackers and provides you with notification if someone is trying to access your account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.