The short answer
Open the account's Settings, look under Security for “2-Step Verification,” “Two-factor authentication” or “Passkeys,” and turn it on. An authenticator app or a passkey is safer than text-message codes, but any second step is much better than none.
Watch: Make Your Accounts Safer with Multifactor Authentication (MFA)
A short animated video from CISA, the U.S. Cybersecurity and Infrastructure Security Agency, explaining how multifactor authentication protects your accounts. Video by CISA. Watch on YouTube ↗
Passwords leak all the time, through data breaches, fake login pages and guessing. Two-factor authentication (often called 2FA, two-step verification or MFA) adds a second check, so a stolen password alone isn’t enough to get into your account.
How it works
When you log in, you give two things:
- Something you know: your password.
- Something you have: your phone, an app, or a security key.
A criminal across the world might have your password, but not your phone. That’s why the FTC recommends turning on two-factor authentication wherever it’s offered.
Which type should you choose?
| Method | How it works | How safe |
|---|---|---|
| Passkey | Your phone or computer confirms it’s you with your fingerprint, face or PIN | Strongest and easiest |
| Security key | A small USB or NFC device you tap | Very strong |
| Authenticator app | An app shows a new 6-digit code every 30 seconds | Strong |
| Text message (SMS) code | A code is texted to your phone | Better than nothing, but texts can be intercepted |
If an account offers a passkey or an authenticator app, pick that. If it only offers text codes, still turn them on.
Where to find the setting
The wording changes from site to site, but the path is almost always similar:
- Open Settings or Account.
- Go to Security or Login & security.
- Look for 2-Step Verification, Two-factor authentication or Passkeys.
- Follow the steps, and save your backup codes somewhere safe, like a password manager or a printed copy at home.
Which accounts to protect first
Start with the accounts that unlock everything else:
- Your email. Whoever controls it can reset your other passwords.
- Banking and payment apps.
- Your phone account (Apple ID or Google account).
- Social media and shopping accounts that store your card.
One warning: never share your code
Scammers sometimes call or text pretending to be your bank, asking you to “confirm” the code you just received. A real company will never ask you to read that code back to them. If someone asks, hang up. It’s a scam.
Related guides
Two-factor works best with strong, unique passwords. If you think an account was already taken over, see what to do if your email is hacked.
The bottom line
Ten minutes of setup on your email and bank accounts blocks the most common way accounts get stolen. Turn it on today, and never share the codes.
Frequently asked questions
Is text message (SMS) two-factor authentication safe?
It's much safer than having no second step, but text messages can be intercepted, for example through SIM swapping. Use an authenticator app or a passkey where you can.
What if I lose my phone?
That's what backup codes are for. Save them when you turn on two-factor authentication, and add a second method, like a security key or backup phone number, where the service allows it.
Should I ever share a two-factor code?
No. No real company will ask you to read a login code back to them. Anyone who asks is trying to get into your account.
Why you can trust this guide
- Based on official sources. The steps here are checked against the 2 official sources listed below, such as the help pages of the companies involved.
- Checked and dated. Last checked on November 6, 2026. We update guides when software or advice changes.
- Independent. No company paid for or reviewed this guide. We don't sell products, and ads never influence our advice.
- Open to corrections. Spotted an error? Tell us and we'll fix it. Read how we research.
Sources
- FTC — Use two-factor authentication to protect your accounts
- U.S. PIRG — Worried about a data breach or identity theft?
This guide is general information. Menus and features can change with software updates, and steps may differ on your device or version. Back up important data before making big changes. Read our disclaimer.
