Two-factor authentication explained: the easiest way to protect your accounts
A stolen password is far less dangerous when your account also needs a second check. Here's how two-factor authentication works and which type to choose.
Passwords get stolen all the time, through data breaches, phishing emails and malware. Two-factor authentication (2FA) is one of the simplest ways to stop a stolen password from turning into a hacked account.
What is two-factor authentication?
Normally, you log in with one thing: your password. With 2FA, you need two different kinds of proof:
- Something you know: your password
- Something you have: your phone, an app or a security key
Even if a criminal learns your password, they can’t log in without the second step. You may also see the terms “two-step verification” or “multi-factor authentication (MFA)”. They mean almost the same thing.
The main types, from good to best
1. SMS text codes (good)
A six-digit code is sent to your phone by text message. It’s easy, but it’s the weakest option, because criminals can sometimes trick phone companies into moving your number to their SIM card (a “SIM swap”). Still, SMS is much better than no 2FA at all.
2. Authenticator apps (better)
Apps like Google Authenticator, Microsoft Authenticator or the code feature in password managers generate a new code every 30 seconds on your phone. The codes never travel over the phone network, so SIM swaps don’t work.
3. Prompts on a trusted device (better)
Some services, such as Google and Microsoft, send a “Is this you trying to sign in?” message to your phone. Only tap Yes if you really are signing in at that moment.
4. Passkeys and security keys (best)
Passkeys let you sign in with your fingerprint, face or phone PIN instead of a password. Security keys are small USB or NFC devices you tap to log in. Both are very resistant to phishing, because they only work on the real website.
Any 2FA is better than none. Start with what’s easy, then upgrade when you can.
Which accounts to protect first
- Your main email: it can reset every other password, so protect it first
- Banking and payment apps
- Social media (Facebook, Instagram, X, LinkedIn)
- Cloud storage (Google Drive, iCloud, OneDrive)
- Work accounts and anything with saved card details
How to turn it on
The steps are similar on most services. Go to your account’s Security or Privacy settings and look for “Two-factor authentication”, “2-Step Verification” or “Passkeys”. Then follow the instructions to link your phone or app.
Don’t forget your backup codes
When you turn on 2FA, most services give you a list of backup codes. Save them in a password manager or print them and keep them somewhere safe. If you lose your phone, these codes are often the only way back into your account.
Watch out for this trick
Scammers may call or message you pretending to be your bank or a tech company and ask you to read out a code you just received. Never share a 2FA code with anyone. Real companies will never ask for it.
