How to Set Up Two-Factor Authentication (and Which Kind to Use)

Passwords leak. They get phished, guessed and dumped in data breaches. Two-factor authentication (2FA), also called multifactor authentication (MFA), adds a second check when you sign in, so a stolen password alone isn't enough. It takes a few minutes per account, and it is one of the steps US agencies such as CISA and the FTC most consistently recommend.

How it works

When you log in, a site asks for two different kinds of proof:

• Something you know: your password or PIN.
• Something you have: your phone, an authenticator app or a physical security key.
• Something you are: a fingerprint or face scan, usually used to unlock the device holding your key.

Even if a criminal has your password, they also need the second factor, which is physically with you.

The main methods, from weakest to strongest

Text message (SMS) or phone call codes

The site texts or calls you with a one-time code. It's easy and works on any phone, but codes can be intercepted. In a SIM swap, a criminal convinces a carrier to move your number to their device; phishing sites can also trick you into typing the code. Use SMS only when nothing better is offered.

Email codes

Similar to SMS, and only as secure as your email account. Make sure your email has strong 2FA itself.

Authenticator apps

Apps such as Google Authenticator, Microsoft Authenticator, Authy, or the built-in code generators in many password managers produce a six-digit code that changes every 30 seconds. Codes are created on your device, so SIM swapping doesn't affect them. They can still be phished if you type a code into a fake site.

Push notifications

Some services send a prompt to your phone asking "Is this you trying to sign in?" Convenient, but attackers sometimes spam prompts hoping you'll tap Approve, a tactic known as MFA fatigue. Many services now show a number to match or a location to reduce this risk. Never approve a prompt you didn't trigger.

Security keys

A physical key, plugged into USB or tapped via NFC, using the FIDO standards. Security keys are phishing-resistant: the key checks the website's real address and won't respond to a fake one. They are the strongest common option and are recommended for high-risk accounts.

Passkeys

Passkeys use the same FIDO technology as security keys but live on your phone, computer or password manager, unlocked with your face, fingerprint or device PIN. They replace the password entirely for sites that support them and are also phishing-resistant. Apple, Google and Microsoft support passkeys, and adoption by major sites has grown quickly.

Which accounts to secure first

Start with the accounts that can unlock or drain everything else:

1. Primary email. It's used to reset passwords for nearly everything.
2. Apple, Google or Microsoft account. It controls your phone backups, photos, passwords and app purchases.
3. Banking, credit cards and investment accounts, including payment apps such as PayPal and Venmo.
4. Phone carrier account. Set a strong account PIN and turn on any port-out or SIM protection your carrier offers.
5. Password manager.
6. Social media, which is often used for impersonation scams.
7. Shopping accounts with saved cards.
8. Government accounts. Federal agencies such as the IRS and Social Security Administration use sign-in services that require multifactor authentication.

Step-by-step setup

The menu names vary, but the process is similar everywhere:

1. Sign in to the account on a computer or in the app.
2. Go to Settings, then Security, Sign-in or Login & security.
3. Look for Two-factor authentication, 2-step verification, Multifactor authentication or Passkeys.
4. Choose the strongest method offered: passkey or security key first, then authenticator app, then SMS.
5. For an authenticator app, scan the QR code shown on screen, then type the code the app shows to confirm.
6. Save the backup codes in your password manager or print them and store them safely.
7. Add a second method if possible, such as a backup security key or a second device.

Setting up 2FA for the whole household

Two-factor authentication works best when everyone in the home uses it, because family accounts are often linked through shared payment methods, cloud storage and streaming logins.

• Children and teens. Turn on 2FA for their email and gaming accounts, which are common targets. Platform family settings often let a parent approve purchases and manage security.
• Older relatives. A passkey or push prompt is usually easier than typing codes. Set it up together, store backup codes with their important papers, and show them what a legitimate prompt looks like.
• Shared accounts. For a streaming or utility account several people use, a password manager's shared vault, which can also store an authenticator code, avoids texting codes back and forth.
• Small businesses. Require multifactor authentication on email, payroll, banking and cloud accounts, and give employees security keys for high-risk roles such as finance and administration.

Don't lock yourself out

The biggest worry with 2FA is losing your phone. Plan for it:

• Store backup codes for every account.
• Register two security keys if you use them, and keep one at home.
• Use an authenticator with secure backup or sync, or note which accounts are in your authenticator so you can move them to a new phone before wiping the old one.
• Keep your recovery phone number and email current.
• Move authenticator accounts before trading in a phone. Many apps have an export or transfer feature.

Watch for 2FA scams

Criminals know about 2FA and try to talk their way around it:

• No real company will ask you to read a verification code aloud. If someone calls or texts asking for "the code we just sent," it's a scam; they're trying to log in as you.
• Don't approve sign-in prompts you didn't start.
• Type addresses yourself or use bookmarks instead of clicking login links in texts and emails.
• If you suspect someone has your password, change it, sign out of all sessions and review the account's security settings.

Turning on two-factor authentication for your top five accounts takes less than an hour. Upgrading those accounts to passkeys or security keys over time makes them dramatically harder to steal, even when the next big password leak hits the news.