2FA refers to the use of two different types of authentication factors to verify a user's identity. These factors can come from any two of the following three categories:
Something you know: This could be a password, PIN, or the answer to a security question.
Something you have: This could be a smartphone (to receive an SMS or use an authenticator app), a smart card, or a hardware token.
Something you are: This refers to biometric data, like a fingerprint, facial recognition, or retina scans.
An OTP is valid for only one login session or transaction, and it relies on something you have. After entering a password (something you know), you might be sent an OTP via SMS to your phone (something you have), which you must then enter to gain access.