Choose the Right Two-Step Verification for Your Accounts

Add a separate proof

Two-step verification asks for an additional proof after a password, such as a code, an approval in an app, or a security key. This reduces the value of a stolen or reused password because an attacker needs another factor too. Turn it on first for your email account, since email often controls password resets elsewhere. Use each service's own account-security page rather than links in unsolicited messages.

Compare the options

An authenticator app generates codes without depending on a text message arriving, while a hardware security key or passkey can provide stronger resistance to fake sign-in pages when a service supports it. SMS is more convenient than no second factor, but phone-number takeover and delivery problems make it a less robust option. Choose a method you can use reliably, and check whether it works on all devices you depend on.

Avoid locking yourself out

Before replacing a phone, add a backup factor or confirm the service's recovery process. Save recovery codes offline in a place you can find, not in the same account they unlock. Remove lost devices and old phone numbers from account settings. If a login request arrives when you are not signing in, deny it and review recent activity; repeated unsolicited prompts can be an attempt to wear you down.

Sources and further reading

• CISA: Turn On MFA
• FTC: Use Two-Factor Authentication