Turn on 2-step verification

What 2-step verification is

Normally you log in with just a password. With 2-step verification (often shortened to 2SV, and also called two-factor authentication, 2FA or MFA), you also have to prove it is you in a second way.

Think of a bank cash machine. You need your card and your PIN. Someone who only knows your PIN cannot take money without the card. 2SV works the same way online: a criminal who steals your password still needs your phone or security key.

Passwords leak more often than people think. Websites get broken into, people get tricked by fake login pages, and harmful programs can record what you type. You cannot control all of that, but 2SV means a leaked password is usually not enough on its own. It is one of the most effective security steps an ordinary person can take, and on most accounts you only see the extra step when you log in on a new device.

The different kinds of second step

Any of these is far safer than a password alone. Use whatever the service offers and you find easiest. You can see how authenticator codes are made with our one-time code demo tool.

How to turn it on

Every service is slightly different, but the steps are similar:

1. Sign in to the account on its official app or website.
2. Open Settings, then look for Security, Sign-in, or Password and security.
3. Find 2-step verification, two-factor authentication or passkeys and choose to turn it on.
4. Pick your method. If you choose an authenticator app, you will scan a square barcode (a QR code) with the app.
5. Save your backup codes. The service gives you a few spare one-time codes. Print them or write them down and keep them somewhere safe at home.
6. Test it by signing out and back in.

Tip: Start with your main email account. If someone controls your email, they can reset the passwords for almost everything else.

Which accounts first?

1. Your main email.
2. Online banking and payment apps (many already require it).
3. Social media and messaging apps such as WhatsApp.
4. Shopping accounts with saved cards.
5. Your phone account with Apple, Google or Microsoft, which may hold your photos and backups.

Mistakes to avoid

• Never share a code. Banks and companies will never phone or message to ask for the code you were just sent. Anyone who asks is a scammer.
• Never approve a login you did not start. If you get a sudden prompt or code you did not request, someone may have your password. Say no, then change your password.
• Do not lose your backup codes. If you change phones, set up your authenticator app on the new phone before wiping the old one.
• Keep your phone number up to date in your account settings.

2SV works best alongside a strong, unique password. See strong passwords made easy, or for the technical detail, our note on strong passwords and MFA.