Two-factor authentication: what it is, which method to choose and how to set it up

If someone gets hold of your password — because you reuse it, because it leaked in a breach, or because you fell for a phishing email — they can log into your account. Two-factor authentication (2FA, also called two-step verification or MFA) adds a second check: as well as the password, you need something only you have, such as your phone or a physical key. Cybersecurity agencies such as the US Cybersecurity and Infrastructure Security Agency (CISA) rank it among the most effective steps anyone can take.

#How it works

When you sign in on a new device:

1. You enter your password (something you know).
2. The service asks for a second proof — something you have, such as a code from your phone or a security key, or something you are, like a fingerprint, via your device.

Even with your password, an attacker can't get in without that second factor.

#Which method to choose

Rule of thumb: use at least an authenticator app or phone prompts on your important accounts. If SMS is the only option, turn it on anyway.

#Which accounts to protect first

1. Your main email. It's the master key — it can reset the passwords for almost everything else.
2. Your Google, Apple or Microsoft account, which controls your phone, photos and backups.
3. Banking and payments.
4. Social media and messaging, such as WhatsApp.
5. Your password manager, if you use one.
6. Work accounts.

#How to turn it on (general steps)

Menus differ between services, but the process usually goes:

1. Open your account settings and go to Security.
2. Look for 2-Step Verification, Two-factor authentication or Two-step sign-in.
3. Choose a method. For an authenticator app, scan the QR code on screen with the app.
4. Enter the code the app shows to confirm.
5. Save your recovery codes (see below).
6. Add a backup method if the service allows it.

Google and Microsoft have step-by-step guides in their help centres, linked in the sources.

#Recovery codes: don't skip them

When you enable 2FA, many services give you a list of one-time codes for getting in if you lose your phone. They're as important as your password:

• Store them off your phone: on paper somewhere safe, or in your password manager.
• Don't keep them in an unprotected note or in the email account they unlock.
• If you use one, generate a fresh set when you're running low.

#When you change phones

Before wiping or selling your old phone:

• Move your authenticator app: many let you export accounts or sync them, encrypted, to your account.
• Confirm you can sign in to your important accounts with the new phone before erasing the old one.
• If you lose access, use your recovery codes or the service's account recovery process.

#Common myths

• "It's a hassle." Most services only ask when you sign in on a new device.
• "Nobody cares about my account." Attacks are usually automated and massive, trying leaked passwords on thousands of accounts.
• "A strong password is enough." A strong password won't save you if it leaks or you type it into a fake site.

#The bottom line

Turning on 2FA for your email, main accounts and banking takes a few minutes and blocks most break-ins with stolen passwords. Use an authenticator app or security key where you can, keep recovery codes off your phone, and never approve a prompt you didn't start. Pair it with a password manager, and if you think someone's already in, follow our guide to recovering a hacked account.