Two-factor authentication adds another check when you sign in, so a stolen password alone is usually not enough to enter your account. It can use an authenticator app, a security key or a text message, depending on the service.
The important part is not only switching it on: you also need a recovery plan for a lost or replaced phone. Start with your main email account, because it is often used to reset the passwords for other accounts.
Step 1: Open the real account security settings
Open the service's official app or a website you already trust. Look under Account, Security or Sign-in for Two-step verification, Two-factor authentication or 2FA. Do not follow an unexpected email link to enable it.
Before you start, check that your recovery email and phone number are current and that your password is unique. Use a private device and allow enough time to finish setup without rushing.
Step 2: Choose a supported sign-in method
- Security keys and passkeys offer strong phishing resistance where supported. A passkey can replace password-based sign-in; it is not simply another six-digit code. Check how your service and device handle recovery and synchronisation.
- An authenticator app generates short-lived codes and usually works without mobile signal. It is a good widely supported choice, though a fake website can still trick you into sharing a code.
- App-based approval prompts are convenient, but approve only a sign-in you started. Use number matching if offered and deny unexpected requests.
- SMS codes are better than having no second factor, but phone-number takeover and intercepted messages make them less secure than stronger supported options.
Step 3: Set up an authenticator app carefully
If you choose an authenticator, install a reputable app from the official app store. In your account's 2FA setup, scan the displayed QR code with the authenticator or enter the setup key manually. Enter the current code back into the service to confirm setup.
The QR code and setup key are secrets: anyone who copies them may be able to generate your codes. Do not send them to support, include them in screenshots or leave them in a shared folder. Wait for the service to confirm that two-factor authentication is enabled.
Step 4: Save recovery codes before signing out
Many services give you backup or recovery codes. Save them in a trusted password manager or print them and keep the paper securely. Do not keep your only copy on the phone you might lose.
Recovery codes are usually single-use. Mark a code as used after using it, and regenerate the set if it has been exposed. If the service lets you register a second security key or another recovery method, consider adding one.
Step 5: Test it without losing your current session
Keep your current session open while testing sign-in in another browser window or on another trusted device. Confirm that your password and second factor work, and that you can locate your recovery options.
If the authenticator code is rejected, check that you chose the right account and that the phone's date and time are set automatically. Wait for a fresh code and retry. Do not repeatedly approve prompts you did not request.
Before changing or resetting your phone
- Transfer your authenticator accounts using the app's official transfer or backup process. Some apps sync accounts and others do not; verify yours rather than assuming.
- Test sign-in using the new phone before wiping the old one. Also check passkeys and the account that stores any synced credentials.
- If your phone is lost, use a backup method or the service's official account recovery process. Once back in, remove the lost device and review recent activity.
- Never pay someone promising to bypass two-factor protection. Genuine recovery may take time and require proof of account ownership.
Tips and tricks for safer everyday use
- Protect email, your password manager, financial accounts and social accounts first, using the strongest methods each supports.
- Never give a one-time code or recovery code to someone in a call or chat. Enter codes only into a sign-in you initiated on the genuine service.
- Keep a screen lock on your phone and update it regularly. Two-factor authentication does not protect an already-unlocked device or every stolen session.
- Review trusted devices and recovery details periodically, especially after a phone-number change.
- If unexpected prompts keep arriving, deny them, change your password through the official service and review account activity.
A good setup combines a unique password, a strong supported sign-in method and recovery options you can actually use. Spending a few extra minutes testing recovery now can prevent a lockout later.
If you need help choosing a method, use Digital Checkup and name the service. Never include passwords, QR setup codes, one-time codes or recovery codes.