Two-step verification: why it matters and how to switch it on

Give your important accounts another layer of protection.

The answer in 2 lines. Two-step verification adds an extra check when you sign in or make a sensitive change. A stolen password becomes less useful to a criminal. Start with your email, then protect other important accounts. Open each account directly, find its security settings and follow the setup instructions. Save a recovery option before finishing. Never share a sign-in code with an unexpected caller or approve a request you did not initiate. This protection reduces risk; it does not make every scam impossible.

Set it up without locking yourself out

Start with your email: open the account independently and find security or sign-in settings. Look for two-step verification, two-factor authentication or multi-factor authentication.
Choose an available method: follow the service's instructions and complete its verification check. Confirm that setup has finished successfully.
Prepare recovery: save backup codes securely, if offered, or configure another supported option before relying on your usual phone.

Stop: danger

An unexpected approval prompt: refuse it. Open the account independently to review security activity rather than following the prompt's accompanying message.
A caller wants your sign-in code: do not read it out or send it. End the conversation and verify the request through a contact route you already trust.
A supposed helper wants your recovery codes: keep them private. They can provide access when the normal verification method is unavailable.

Which method should you choose?

The National Cyber Security Centre's setup guide explains text messages, authenticator apps, approval prompts and security keys. Read its method sections and choose an option your account supports and you can reliably use.

A text uses your phone number. An authenticator app generates codes and can work without a mobile signal. Some services offer an approval notification or a physical security key instead. Availability differs between accounts: you do not need to buy equipment simply because a suspicious message tells you to.

Make a plan for a lost or replaced phone

Before changing phones, open each important account's security settings and check how to move its verification method. Do not erase or dispose of the old device until you have confirmed that the replacement works.

If backup codes are provided, keep them somewhere secure that you can reach without signing into the account they protect. A paper copy stored safely can be practical. Treat these codes like passwords. Check your recovery contact details while you are already in the settings, especially if your phone number has changed.

What not to do

Approving repeated prompts simply to make them stop.
Keeping your only recovery information inside the account you might be locked out of.
Assuming that an unexpected code proves an intruder successfully accessed the account.
Reusing a weak password because an additional check is enabled.

Choose the next accounts by what you could lose

After email, consider banking, saved payment details, private documents and accounts used to contact friends or family. Make a personal checklist and mark each account only when setup and recovery are complete. For banking, follow the security options offered inside your existing app or account.

The NCSC's online security checklist brings account protection together with software updates and backups. Open the relevant topic and use it to identify the next useful action, rather than trying to change every setting at once.

Stay alert after switching it on

A criminal may still try to persuade you to reveal a code or approve their login. Enter codes only when you have independently opened the genuine service and initiated the action. Read what an approval request is actually authorising.

For suspicious messages, use the NCSC's phishing reporting guidance: select the section matching the email, website or message you received and follow its reporting instructions. If an incident becomes cyber crime or fraud, open Report Fraud and select the appropriate reporting option. Its route covers England, Wales and Northern Ireland; Scotland's route differs.

Good to know

An account may remember a trusted device, so an extra check is not necessarily requested at every visit.
A security question is not equivalent to two-step verification; enable the additional protection where available.
If you are already locked out, follow account recovery first. Enabling extra protection is part of securing access after recovery.

Illustrative example: Aisha in Birmingham enables an authenticator for her email and stores the recovery codes securely. Before replacing her phone, she checks the account's transfer instructions and confirms that the new device works. Later, she refuses an unexpected approval request and reviews the account directly rather than accepting it.

A made-up story, for illustration.

Bobby

Sources, verification, confidence

Verified on 5 November 2026, for England. Confidence: high for the purpose of two-step verification, supported method categories and recovery planning; medium for individual service menus and transfer procedures. Available methods vary, and additional verification does not remove every risk.