Two-factor authentication: why you need it and how to turn it on

A stolen password should not be enough to open your account.

The answer in 2 lines. Two-factor authentication adds another kind of proof to signing in, such as a security key or a code from an authenticator application. Turn it on for email and financial accounts, then other sensitive services. Choose a phishing-resistant option when available and keep a recovery method somewhere safe. Text codes still offer useful protection when stronger methods are unavailable. Never approve a sign-in you did not initiate.

Set it up account by account

Open the account yourself. Find Security or Sign-in settings and look for two-factor authentication, two-step verification or multifactor authentication.
Choose an available method. The CISA setup sheet walks through finding the setting, selecting extra protection and confirming enrollment.
Prepare for losing your device. Save any recovery codes securely and enroll an additional supported method when possible.
Finish and check. Complete the service's verification step, then confirm that the method appears in your security settings.

Stop: danger

An unexpected approval request: deny it. Open the account independently and review its security activity.
A caller asks for your sign-in code: do not share it. A convincing story does not make an unsolicited request safe.
A message says to disable protection: do not follow its link. Check the account through its established app or website.

Choose a method you can maintain

Security key or supported passkey: phishing-resistant authentication ties the sign-in to the legitimate service. A passkey may replace password entry rather than add a separate code.
Authenticator application: generates a changing code or presents an approval request. Code-based methods remain vulnerable if you enter the code on a fraudulent site.
Text or email code: useful when stronger options are unavailable, but dependent on the security of that phone number or inbox.

For the technical distinction, see CISA's phishing-resistant authentication guide. Read its explanation of phishing-resistant methods before comparing options in your account. Availability varies; you do not need to postpone all protection while waiting for your preferred method.

What not to do

Approving repeated prompts simply to make them stop.
Keeping recovery codes only on the phone you would need to replace.
Erasing an old device before transferring or reenrolling authentication methods.
Assuming every account offers the same methods or recovery process.

Make recovery part of setup

For a concrete US government example, open the federal sign-in service's authentication options. Compare its supported methods and follow the instructions for the option you select. Its advice to maintain additional methods helps prevent lockout when a device is unavailable.

If you use that service's recovery codes, read its backup-code instructions. Store codes with the care you give a password and follow the service's rules for using and replacing them. Other accounts may work differently.

Before changing phones, make a private inventory of accounts using the old device. Transfer or reenroll each method using the account's own instructions. Confirm access from the replacement before removing the old method. Never send screenshots of setup secrets or recovery codes to someone offering unsolicited help.

Where to start in the United States

Prioritize your primary email, financial accounts, tax services and social accounts. Then protect shopping and other accounts holding personal information. The FTC consumer guide explains common methods and how to find account settings; use it as a checklist while reviewing your accounts.

For an unexpected code, do not assume either that a takeover succeeded or that everything is safe. Review the account directly. If you find unfamiliar access or changed recovery details, secure the account and replace its password. For work or school accounts, follow the organization's established security process.

Good to know

Stronger sign-in protection reduces risk; it does not make fraudulent payment requests or malicious downloads harmless.
An authenticator code is different from a recovery code. Follow the account's instructions for each.
Requirements vary by service. Do not assume a single nationwide setup rule applies to every US bank or government account.

Illustrative example: Avery enables an authenticator for email and stores recovery information securely. Before replacing the phone, Avery transfers the method and tests access. Later, an unexpected approval request is denied, and Avery checks the account directly instead of responding to the notification.

A made-up story, for illustration.

Bobby

Sources, verification, confidence

Verified on November 5, 2026, for the United States. Confidence: high for authentication principles, method selection and recovery planning; medium for individual account menus and availability, which vary by service.