The short version: two-factor authentication (2FA) adds a second check after your password. Turn it on first for your main email account.
A password is one lock. 2FA adds a second lock.
Think of a door with one lock. A second lock makes it harder.
What 2FA is
2FA means you prove who you are in two different ways. Usually that is:
- Something you know, like your password.
- Something you have, like your phone, an app on it, or a small security key.
- Something you are, like your fingerprint or your face.
You need two of these to sign in.
You will see other names for the same idea. Multi-factor authentication (MFA) is the general name. It is the term the US agency CISA uses. 2-step verification (2SV) is the term often used in the UK. Google uses “2-Step Verification”. We mostly say 2FA here.
Why it helps
Passwords can be guessed, stolen, or given away after a trick. With 2FA turned on, a stolen password is not enough on its own. A criminal also needs your second step. CISA says this is why 2FA can make you significantly safer online.
2FA is not perfect. A fake website can still trick people into typing a code. That is why the kind of second step matters.
Kinds of second step, from stronger to weaker
| Second step | What it is | How strong |
|---|---|---|
| Passkey or security key | A passkey lets you sign in with your fingerprint, face or phone screen lock. A security key is a small device you plug in or tap. See passkeys. | Strongest. They help against fake websites. |
| Authenticator app code | An app on your phone shows a new code, usually six digits, about every 30 seconds. See authenticator apps. | Strong. Better than a text message. |
| Code by text message or email | A service sends a code to your phone number or email. See why not text-message codes. | Weakest common choice. |
CISA ranks them in this order. Security keys are strongest, and apps are safer than text or email codes. A criminal can take over your phone number and get your text messages. That is called a SIM swap.
If a site offers only text message or email codes, use them. It is better than nothing: any 2-step verification is better than none. CISA’s guidance for organizations says these codes should be a last resort. Switch to an authenticator app or a passkey when the site offers one.
Where to turn it on first
Go in this order.
- Your main email account. Email can reset the passwords for your other accounts. See secure your email.
- Bank and money apps.
- Your Apple, Google or Microsoft account.
- Your password manager. See password managers.
- Social media and shopping accounts.
How to turn it on
Steps are similar on most sites:
- Sign in and open Settings. Look for Security, Sign-in or Account.
- Find 2-step verification, two-factor authentication or multi-factor authentication.
- Choose a passkey or an authenticator app if offered.
- Save your backup codes. These are one-time codes for when you lose your phone. Keep them somewhere safe. See recovery codes and backups.
Example: Google Account
- Open your Google Account.
- Choose Security & sign-in.
- Under How you sign in to Google, choose Turn on 2-Step Verification.
- Follow the steps. Add a passkey or an authenticator app, and save the backup codes.
Google may suggest “Google prompts”. These are tap-to-approve messages on your phone. Google says they help against phone-number attacks.
Example: Apple Account
Apple says most Apple Accounts already use two-factor authentication. To check on an iPhone or iPad, open Settings, tap your name, then tap Sign-In & Security. On a Mac, open System Settings, click your name, then click Sign-In & Security.
What it feels like every day
After you set it up, most sites ask for the second step only in some cases. These include a new device or a big change, such as a new password. Some sites offer “remember this device”. Use it only on your own devices.
Before you erase an old phone, read recovery codes and backups. It explains how to move your codes to a new phone.
Never share a code
If someone who contacted you asks you to read out a code, it is a scam. This is true even if they say they are your bank, a tech company or a government agency. Google says you will not get a call from Google to check a code.
If this happens:
- Hang up or stop replying.
- Do not share anything.
- Contact the company using a phone number from its real website or your card.
If you get a code or sign-in approval you did not ask for, someone may be trying to get into your account, or someone may have typed your number or email by mistake. Do not approve it or share the code. An unexpected approval request can mean an attacker knows your password, so change the password on a device you trust. Then check that 2FA is on.
If you lost money or lost control of an account: in the US, report it at reportfraud.ftc.gov. In England, Wales and Northern Ireland, use Report Fraud (formerly Action Fraud) at reportfraud.police.uk. In Scotland, call Police Scotland on 101. For a scam text, forward it to 7726 in the US and the UK. This is free in the UK. AT&T says it is free for its customers.
Do this today (about 8 minutes)
- Open the security settings of your main email account.
- Turn on 2-step verification. Choose a passkey if the site offers one, because it uses your phone screen lock. Otherwise choose an authenticator app. Avoid text message codes if you can.
- Save the backup codes in a safe place.
Another day: repeat for your bank and money apps.
Never type a code or password into this website, and never read a code out to someone who contacts you.
Checked: 25 Oct 2026. Settings screens change. If yours looks different, search the company's help page.
