Two-Factor Fortress¶

A row of terracotta pots labelled TREASURE CHEST, SECRET DIARY, COOKIE JAR, PHOTO ALBUM and GAME SCORES stands along a potting bench. One child reaches for a pot holding two cards at once, a password and a code, while the others keep their own cards fanned and close. An hourglass runs beside the pots and the chalkboard reads TWO-FACTOR FORTRESS.

Six containers stand in a row, each holding a token, each one an account. Half the players are Attackers and half are Account Owners. Halfway through, they change places.

The passwords are already gone. Every password sits face up from the start, because passwords leak, and the part worth playing begins after they have. What the Account Owners still hold is the second factor.

The accounts¶

Not all of them are worth the same.

Account	Worth
Email	4
Treasure chest	3
Secret diary	2
Photo album	2
Cookie jar	1
Game scores	1

Email is the recovery path. If it falls, the Attackers take one more account of their choosing straight away and pay nothing for it, because whoever holds email can reset the rest. The one exception is below.

What holds and what falls¶

At the start the Account Owners deal their six protections face-down, one to each account: one hardware key, two authenticator apps, three text messages.

	Relay	SIM swap	Device theft
Text message	falls	falls	falls
Authenticator app	falls	holds	falls
Hardware key	holds	holds	falls

Text messages fall to nearly anything. There are three of them, so one generally ends up somewhere it will be missed. An authenticator app survives a SIM swap and not a live relay. The hardware key survives both, because it answers only to the genuine site and will not hand anything to a convincing fake. Nothing survives a device that is already compromised, and there is exactly one device theft card in the game.

If email falls while the hardware key is on it, the Attackers take email and nothing else. Account recovery asks for the second factor too, so the key that failed to stop the theft still stops the cascade.

How a round goes¶

The Attackers name the account they are going to attack, out loud.
The Account Owners may swap the face-down protections on any two accounts, or leave them. Everyone sees which two accounts were swapped. Nobody sees what moved.
The Attackers play one attack card face up.
The named account’s protection turns over. The grid decides it.

A protection that held goes back face-down. An account that fell is out, and its protection leaves with it. An account that survived can be named again next round.

The Attackers have five attacks for the whole game: two relays, two SIM swaps, and one device theft. They are played face up and stay where everyone can see them, so both sides always know what is left in the attackers’ hand.

The game ends when the fifth attack is played, or when nothing is left to attack. Then the sides change over and play again from a full row. Whoever held more points as Account Owner wins. If the points are level, the game goes to whoever still held email.

What you need¶

Six containers that hold a token and can be labelled, and a token for each. Six protection cards: one hardware key, two authenticator apps, three text messages. Five attack cards: two relays, two SIM swaps, one device theft.

The other five can be swapped for whatever a particular household would actually mind losing, and their worth set to match. Four, three, two, two, one and one is one spread that plays well. Email being worth most is what gives the row its shape; the rest of the numbers are a starting point.

Last reviewed: 2026-07-08.