The Economist explains: How do two-factor logins improve security?
Two-factor authentication relies on a combination of two separate credentials. One is typically a standard password. The other is a one-time passcode, often sent to a mobile phone. The method by which the code is delivered is "out of band" and cannot be intercepted by the attacker.