Two-factor authentication for fund movement: why it is non-negotiable
Password vs 2FA — what each actually protects
A password protects access to your account. It stops someone from logging in, viewing your dashboard, or changing your settings. But once an attacker has your password — through a breach, phishing, or a reused credential — they have everything.
Two-factor authentication (2FA) protects the actual movement of funds — the moment that matters most. Even if your password is compromised, an attacker can't send money without a second factor that only you possess.
Why 1TCH requires 2FA on every transfer
Most banks only require 2FA at login. Once you're in, you can transfer freely. That's convenient — but it means a compromised session (via session hijacking, a shared computer, or a stolen cookie) gives the attacker full access to move funds.
1TCH takes a different approach: step-up authentication on every fund movement. Before any transfer is submitted, you must enter a fresh 6-digit code from your authenticator app. The code is time-based (TOTP), single-use, and expires in 30 seconds — so even if an attacker captures it, they can't replay it.
How TOTP works
1TCH uses the TOTP (Time-based One-Time Password) standard — the same algorithm used by Google Authenticator, Authy, and 1Password:
- Enrollment — when you enable 2FA, 1TCH generates a secret key and shows you a QR code. You scan it with your authenticator app, which stores the secret locally on your device.
- Code generation — your app generates a new 6-digit code every 30 seconds, derived from the secret and the current time. The secret never leaves your device.
- Verification — when you enter a code to authorize a transfer, 1TCH's server independently generates the expected code from the stored secret and compares it. If they match and the code hasn't been used, the transfer proceeds.
Why this is stronger than SMS 2FA
SMS-based 2FA sends a code to your phone. It's better than nothing, but it's vulnerable to SIM-swapping attacks — where an attacker convinces your carrier to port your number to their SIM, then receives your codes. TOTP doesn't rely on any phone carrier; the code is generated locally on your device from a shared secret, with no network transmission.
Backup codes — for when you lose your device
If you lose your phone, you need a way back in. 1TCH generates one-time backup codes when you enable 2FA — print them or store them in a password manager. Each code can be used once in place of a TOTP code, and they're invalidated after use. If you lose both your device and your backup codes, account recovery requires identity verification through support.
The audit trail
Every 2FA event is logged: enrollment, code verification, failed attempts, and backup code usage. This audit trail is visible to admins and provides a complete record of who authorized what, when, and from which IP. If a transfer is ever disputed, the 2FA verification timestamp is the proof that the account owner authorized it.
2FA is non-negotiable
In a world where password breaches are routine and phishing attacks are increasingly sophisticated, protecting the login is not enough. The fund movement is the target — and that's where the second factor belongs. 1TCH enforces it on every transfer, every time, with no opt-out.