Once enabled, two factor authentication will require anyone who tries to log in to your account to have physical access to your mobile phone in order to log in, even if they know your password. It basically works like this:
1 – You sign into an account that supports Two-Factor Authentication and add your mobile phone number to the account.
2 – The online service provider sends a text to your phone that contains an authorization code.
3 – You return to the online account and enter the authorization code from the text. That code serves as proof that you own that particular mobile phone.
4 – After your phone number has been verified via the authorization code, the account in question will text a new authorization code to your mobile phone every time someone tries to log into your account. That person (even if it is you) will not be allowed to log in to your account unless they have physical access to your phone since they’ll need to enter the authorization code that’s contained in the text.
As you can see, Two Factor Authentication makes it a LOT more difficult for someone else to log into your account even if they know your password!