A stolen password is the most common way accounts get taken over. Two-step verification adds a second check, so a thief with your password still cannot get in. It takes about ten minutes for your main accounts.
Start with these accounts
- Your main email. It can reset every other account.
- Your Apple or Google account.
- Banking and payment apps.
- Your password manager, if you use one.
- Social media and messaging apps.
Pick the strongest second step you can
Passkeys and hardware security keys come first. An authenticator app is next. Text message codes are the weakest option, but they are still much better than nothing.
Set it up
- Open the account’s security settings and look for “two-step verification” or “two-factor authentication”.
- Choose an authenticator app or a passkey when offered.
- Scan the QR code with the app and enter the code it shows.
- Save the backup codes. Print them or store them in your password manager, not in a screenshot on the same phone.
Avoid the common mistakes
Never share a code with anyone, even someone who says they are from support. Remove old phone numbers from your recovery options. When you change phones, move your authenticator app first and wipe the old phone second.
