Two-step verification (also called two-factor authentication, or 2FA) means that knowing your password is not enough to get into your account. The person also needs something only you have, usually your phone. It stops the large majority of account takeovers, including most of the ones that start with a leaked or guessed password.
The kinds of second step, from weakest to strongest
| Method | How it works | Notes |
|---|---|---|
| SMS code | A code is texted to you | Much better than nothing, but a SIM swap defeats it |
| Authenticator app | Google Authenticator or Microsoft Authenticator shows a code that changes every 30 seconds | Works with no signal or data. Recommended |
| Prompt on your phone | Your phone asks "Is this you trying to sign in?" | Easy, used by Google and Microsoft |
| Passkey | Your phone's fingerprint or face unlock signs you in | Strongest and simplest where available |
Where to switch it on
- Google (Gmail, YouTube, Drive): myaccount.google.com, then Security, 2-Step Verification. Add a backup phone and print or save the backup codes.
- WhatsApp: Settings, Account, Two-step verification. Set a 6-digit PIN and add your email. See WhatsApp taken over.
- Facebook and Instagram: Settings, Accounts Center, Password and security, Two-factor authentication.
- Apple Account: already on for most accounts; check in Settings, your name, Sign-In & Security.
- Microsoft (Outlook, Hotmail, OneDrive): account.microsoft.com, Security, Advanced security options.
- TikTok, X, Snapchat, Telegram: each has it under Security or Privacy settings. Telegram calls it a Cloud Password.
- Your bank and mobile money apps: use the app PIN and fingerprint lock they offer.
Do not lose your way back in
The risk of 2FA is locking yourself out when you lose your phone. Prepare now:
- Save the backup codes each service offers. Write them on paper at home, or store them in a password manager.
- Add a second phone number or a trusted family member's number where the service allows.
- If you use an authenticator app, turn on its backup to your Google or Microsoft account so the codes move to a new phone with you.
The rule that still applies
Two-step verification protects you only if you never read a code out to anyone. A scammer who calls and persuades you to give them the code gets straight in. The code is only ever for you, typed by you, on the real website or app.