Guide Guides
Two-step verification: how to turn it on and which method to choose
A strong password can still leak. Two-step verification (2SV or 2FA) asks for a second check when you log in – a code from an app, a tap on your phone or a security key. It takes a few minutes to set up. Here's where to find it, which method to pick, and how not to lock yourself out if you lose your phone.
Key points
- Two-step verification keeps criminals out even if they know your password – turn it on wherever you can, starting with your email.
- Security keys and passkeys are strongest, then authenticator apps; text messages are weaker but still far better than nothing.
- Set up two methods and keep backup codes away from your phone, or losing the phone can lock you out too.
- Never read a verification code out to anyone. Whoever calls or messages asking for it is a scammer, however official they sound.
What two-step verification is and why you want it
Two-step verification (2SV, also called two-factor authentication or 2FA, and MFA at work) adds a second check to your password. If criminals get your password from a data breach or a phishing page, they still can't get in without your phone or key. The UK's National Cyber Security Centre (NCSC) puts it simply: 2SV helps keep criminals out of your accounts even if they know your passwords – and even accounts with strong passwords benefit from it.
1. Start with your email
The NCSC and the US Federal Trade Commission (FTC) suggest this order:
- Email. Anyone with access to your inbox can use it to reset passwords on your other accounts.
- Banking and payments. Your bank will usually have its own confirmation step (its app or a text code) – check which method you have. Turn 2SV on for other payment services yourself.
- Social media – scammers use hijacked profiles to con your friends.
- Online shopping with saved cards, then everything else.
Look in the account's Security or Sign-in settings for "two-step verification", "two-factor authentication" or "multi-factor authentication". It's usually off by default.
2. Pick your second step
| Method | How it works | How strong |
|---|---|---|
| Security key | small device you plug into USB or hold near your phone (NFC) | strongest (FTC) |
| Passkey | sign in with fingerprint, face or screen lock instead of a password | NCSC recommends it as the default |
| Authenticator app or phone prompt | code from an app (Google Authenticator, Microsoft Authenticator…) or a Yes/No prompt | good – not exposed to SIM swaps, works without signal |
| Text message or call | six-digit code to your phone number | weaker – SIM swap risk; still far better than nothing |
| Email code | code sent to a different inbox | only as safe as that inbox |
The FTC's advice is to use an app or a security key if they're an option. How a SIM swap works and what to do if your phone suddenly loses signal: SIM swap scam. Security questions and "memorable information" don't count: the NCSC says they don't offer the same protection, so turn on 2SV anyway.
3. Turn it on – Google and Apple
Google Account (Gmail, Android, YouTube), following Google's help page:
- Open your Google Account (myaccount.google.com).
- Select Security & sign-in.
- Under How you sign in to Google, select Turn on 2-Step Verification.
- Follow the on-screen steps. Google recommends Google prompts on your phone by default; you can add an authenticator app, a security key and backup codes.
Work or school accounts may be locked down – ask your administrator.
Apple Account (iPhone, iCloud): Settings → [your name] → Sign-In & Security → Two-Factor Authentication, then follow the prompts. Apple says two-factor authentication is already the default for most accounts, so it's mostly a matter of checking it's on and your trusted phone number is current.
For other services (Microsoft, Facebook, Instagram, WhatsApp), look for the same option in the security settings. Menu names change between app versions.
4. A safety net in case you lose your phone
Lose your phone without a backup and you may lock yourself out as well. So, while you're setting it up:
- Add more than one method – an app plus a text number or a security key. The NCSC recommends this precisely because phones get lost.
- Save your backup codes. Each one works only once. Keep them somewhere safe away from your phone – printed at home rather than as a photo in your camera roll. Google tells you not to show them to anyone.
- Only tick "remember this device" on your own phone or computer, never on a public one (FTC).
If your phone is already gone, see Stolen phone: what to do.
5. Never share a code
The easiest way round 2SV is to ask you for the code. Scammers call pretending to be your bank, tech support, or a friend whose text "went to you by mistake".
The FTC is blunt: no matter what the story is, don't share your verification code with anyone you didn't contact first, and treat any unexpected request for one as a red flag. The same goes for phone prompts: if you get a sign-in request you didn't start, tap "No" and change your password – someone knows it.
For how these calls play out, see Bank impersonation scam call and The "Hi Mum, new number" scam.
6. What next
- 2SV doesn't replace a strong password. Use a different one for every service – a password manager makes that painless. Create a strong passphrase with our password generator; it runs entirely in your browser.
- Try passkeys where they're offered. They replace the password with your fingerprint, face or screen lock.
- If someone has already taken over an account, follow Hacked account: what to do. If you typed your password into a fake page, see Entered details on a phishing site.
FAQ
Is two-step verification by text message safe?
It's the weakest common option – the FTC points out that text codes are exposed to SIM swap attacks – but the NCSC says any 2-step verification is better than none. If a service offers an authenticator app or a security key, use that instead.
What if I lose the phone with my authenticator app?
Log in with a backup code or the second method you set up in advance, then move verification to your new phone. That's why the NCSC recommends setting up more than one option and keeping backup codes somewhere safe.
Will I have to enter a code every time I log in?
Usually not. According to the NCSC, most services only ask for the second step when something looks unusual, such as a login from a new device or a password change. Only let a site remember your device if it's your own.
Someone is asking me for the code from a text. What should I do?
Don't give it to them. The FTC's advice is never to share a verification code with anyone you didn't contact first, whatever the story.
Is a passkey the same as two-step verification?
Not quite. A passkey replaces your password with your fingerprint, face or screen lock, and Google says it lets you skip the second step. The NCSC recommends passkeys as the default option wherever a service supports them.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Guide
Data breach: my email or password was leaked – what to do now
An email arrives saying a company you use has “experienced a security incident”. Or you typed your address into Have I Been Pwned and got a red list of breaches. That doesn't mean someone is in your account. It means your details are out there, and sooner or later someone will try to use them: your password on other sites, your email and phone number for targeted scams. Here's what to do right away, what to do this week, and what to watch for in the months after.
Guide
Password manager: how to get started step by step
One password for everything is convenient – right up until one site leaks it. A password manager remembers a strong, different password for every account so you don't have to. Here's how to choose one, set it up and move your passwords across without losing a weekend.
Guide
Account hacked: how to get it back and lock it down
Friends are getting messages you never sent, your password suddenly doesn't work, or you've had an alert about a change you didn't make? Here is what to do, most urgent first – for email (such as Gmail) and Facebook alike.