It is considered 2FA, although you may hear some argue that it's not "true" 2FA. The reason is because the [three factors][1] of authentication are "something the user knows", "something the user has", and "something the user is". Presumably, in 2FA, email is considered "something the user has", although in order to log in to their email, typically all the user needs to know is another set of user name and password (unless your company already had a 2FA on email). Many systems, esp. financial institutions and now Google, FB, Twitter, Microsoft Account etc., will use a phone number because that is more along the lines of what the user has. 2FA is going to be worse login experience than single-factor, but it comes down to what's at stake. If its high business impact information (such as sensitive data, ability to make financial transactions, customer PII), typically 2FA will be favored over user experience. Having said that, security is as good as its weakest link. So even after you applied 2FA for users, if the underlying data was accessible in some other way without 2FA, then it's really annoyance for the users (and yes, I have seen examples of people trying to do that!) [1]: http://en.wikipedia.org/wiki/Authentication#Factors_and_identity