Two-factor authentication: what it is, which kind to use, and how to set it up

A password is something you know. Two-factor authentication adds a second factor of a different kind: something you have (your phone, a security key) or something you are (a fingerprint or face). Someone who steals or guesses your password still cannot log in without that second thing.

You will also see it called two-step verification, 2-step, or multi-factor authentication (MFA). For everyday purposes they mean the same thing. Most sites only ask for the second factor when you log in from a new device or browser, so it adds less friction than people expect.

Passwords leak constantly, through breaches, phishing pages and reuse. You can check yours with our guide to checking if your password was leaked. 2FA is what stops a leaked password from turning into a lost account.

Passkeys and security keys

Passkeys replace the password altogether. Your phone or computer holds a cryptographic key tied to the real website, and you unlock it with your face, fingerprint or device PIN. A fake site cannot use it, because the key only works on the genuine domain. Apple, Google and Microsoft accounts all support passkeys, as do many banks, shops and social networks. Passkeys sync through Apple Passwords, Google Password Manager or a third-party password manager.

Hardware security keys, such as YubiKeys or Google's Titan keys, work the same way but live on a small physical device. They are the strongest common option and are worth considering for your email account if you are a likely target. Always register at least two keys, and keep one somewhere safe at home.

Authenticator apps

Apps such as Google Authenticator, Microsoft Authenticator, Authy or 2FAS generate codes on your phone with no network connection. Many password managers can store these codes too, including Apple Passwords and Proton Pass. Keeping codes in the same place as passwords is a trade-off: very convenient, but it puts both factors in one vault, so protect that vault well. Either way, authenticator apps beat SMS because the code never travels over the phone network.

SMS and email codes

Text-message codes are better than nothing, and for low-value accounts they are fine. Their weakness is the SIM swap: a criminal convinces your carrier to move your number to their SIM card, and your codes go to them. Email codes are only as strong as your email account. Use them where nothing better is offered.

You do not need to do every account today. Start with the ones that unlock everything else:

1. Your main email account. Password resets for almost every other service go here. If an attacker controls your email, they can take the rest.
2. Your Apple ID or Google account. These control your phone backups, photos, saved passwords and device location.
3. Banks, cards and investment accounts. Use the strongest option the bank offers. Many still only offer SMS; take it.
4. Your mobile carrier account. See the next section.
5. Your password manager. If you use one, protect the account that holds the vault.
6. Social media and messaging. Hijacked accounts are used to scam your friends and family.
7. Shopping and payment apps with saved cards, such as Amazon and PayPal.

Look for 2FA in each service's security settings. On a Google account it is under Security, then 2-Step Verification. For an Apple Account, two-factor authentication is on by default for newer accounts; check it on iPhone under Settings, then your name, then Sign-In & Security.

If you rely on SMS codes anywhere, your phone number is a key, and your carrier account is the lock. SIM-swap fraud works by talking or tricking a carrier into transferring your number. Make it harder:

• Set an account PIN or passcode with your carrier, separate from your voicemail PIN.
• Turn on port-out or SIM protection if your carrier offers it. Names vary; look for settings like Number Lock, SIM Protection or Wireless Account Lock in your carrier's app.
• Turn on 2FA for the carrier's own website and app login.
• If your phone suddenly shows "No service" or "SOS only" where it normally works, call the carrier from another phone straight away.

When you turn on 2FA, most services give you a set of one-time backup or recovery codes. They are your way back in if you lose your phone or security key. People skip this step and lock themselves out of accounts permanently, because good security also means support staff cannot easily let you in.

• Print the codes, or write them down, and keep them with important papers at home.
• Or save them in your password manager, as long as you can get into the password manager without the same phone.
• Add a second method where you can: a spare security key, or a second phone for an authenticator app.
• Before you replace a phone, move your authenticator app to the new one. Most apps have a transfer or export option.

2FA can be beaten by tricking you. Two attacks to know:

• MFA fatigue. An attacker who has your password triggers login prompts again and again, hoping you will tap "Approve" to make them stop, or by accident. Sometimes they call or text pretending to be IT support. If you get a prompt you did not start, deny it and change your password: it means someone has it. Number matching, where you type a number shown on the login screen, makes this attack harder, and many services now use it.
• Code phishing. A fake login page asks for your password and then your 2FA code, and passes both to the real site in real time. Or a caller says "we are sending you a code to verify you, read it back to me". No real company asks you to read a code to them. Passkeys and security keys stop this attack entirely.

For more on recognizing fake messages, see how to spot phishing emails.