A password is useful, but it can be stolen, guessed or reused after a data breach. Two-factor authentication adds another check when you sign in, such as a code from an app or a prompt on a trusted device. It can make it harder for someone to enter an account with only your password.
Here’s how to turn it on for important accounts, choose a practical method and prepare for the day you lose your phone. The exact menu names differ by service, but the process is similar.
What you’ll need
- A device you can use to sign in, such as a computer or phone.
- Access to the account’s current recovery email address or phone number.
- A safe place to store recovery codes if the service provides them.
Steps
- Start with your most important accounts. Secure your primary email first, because it may be used to reset passwords elsewhere. Then consider accounts involving money, shopping, health information, social media and cloud storage.
- Go to the service directly. Open its official app or type its known website address into your browser, or use a bookmark you already trust. Don’t use a sign-in link from an unexpected email or text.
- Find the security settings. After signing in, look for a section named “Security,” “Sign-in,” “Account security,” or similar. Search the service’s official help center if you can’t find it. The feature may be called two-factor authentication, two-step verification, multifactor authentication or MFA.
- Check your recovery details. Confirm that the recovery email and phone number shown in your account belong to you and are current. If they are not, update them through the service’s official settings before changing sign-in security.
- Choose an additional sign-in method. Follow the service’s prompts to select a method it supports. Options may include an authenticator app, a security key, a prompt on a trusted device, or a text message. A security key or a prompt that you approve on your own device can be convenient; availability and setup differ by service. If you have a choice, consider a method less dependent on text messages. A text code is still generally an extra barrier compared with a password alone.
- Complete the setup in the account settings. The service may ask you to scan a QR code with an authenticator app, approve a test notification, register a key or enter a code. Follow the instructions on the account’s own screen. Never give a sign-in code or approve a prompt just because someone who contacted you asks you to.
- Save recovery codes if offered. These codes can help you get back in if you lose access to your usual method. Store them somewhere separate from your phone, such as a secure password manager or a private paper copy kept in a safe place. Don’t post them, send them in a message or keep the only copy on the device you might lose.
- Add a backup method if the service allows it. A second trusted device or another supported method can help if your phone is unavailable. Keep backup details current and protected, too; a recovery option that belongs to someone else can put your account at risk.
- Test the new sign-in method. Sign out only if you know how to sign back in, then try a fresh sign-in. Confirm that the added check works and that you can reach your recovery codes or backup method. Don’t disable your existing sign-in method until you’ve confirmed the new setup.
- Repeat for other key accounts. Turn on the feature separately for each service. Enabling it on one email account does not automatically protect your bank, social media or other accounts.
Tips and things to know
Choose security you can maintain
The best available option is one you can use reliably and recover if a device goes missing. Follow each service’s instructions, since not every account offers the same choices. An authenticator app generates sign-in codes on your device; a security key is a separate physical device that you register with an account. Some services also let you approve a sign-in on a device you already trust.
Treat codes and prompts as private
A real sign-in code is for you to enter during a sign-in you started. Don’t read it to a caller or send it to someone in a text or chat—even if they claim to work for the service. Likewise, deny a sign-in prompt you did not request. Then open the account directly and review its security activity if available.
Plan for a lost or replaced phone
Before trading in, wiping or replacing a phone, check the account and authenticator-app instructions for moving access to a new device. Keep recovery codes available away from the phone. If you lose a device, use the service’s official account-recovery process, and remove the lost device from trusted devices when you regain access.
Keep passwords in the picture
This extra check does not make a weak or reused password a good one. Use a different, strong password for each account, and consider a reputable password manager to keep track of them. Keep your devices and apps updated as well.
Turning on two-factor authentication takes a few minutes per account, but the recovery planning matters just as much as the setup. Start with your primary email, save your backup options safely, and then work through the accounts that matter most to you.
