This guide is for anyone who has a password manager, or at least means to get one, but has never switched on two-factor authentication: the small-business owner whose whole company runs through one email account, the parent who manages the family’s bank and streaming logins, the freelancer whose client files live in the cloud. If someone stole your email password tonight, could they get in? For most people without two-factor authentication, the answer is yes.
What two-factor authentication is
Two-factor authentication, often shortened to 2FA, asks for a second proof of identity after your password. Security people describe the factors as something you know (a password or PIN), something you have (a phone or a hardware key) and something you are (a fingerprint or face). Requiring two different kinds means a stolen password alone is not enough.
You will also see the term multi-factor authentication, or MFA, which covers two or more factors. In everyday use the terms mean much the same thing.
The US Cybersecurity and Infrastructure Security Agency puts it plainly on its MFA guidance page: users who enable MFA are significantly less likely to get hacked. It also says that some types are better than others, but any MFA is better than none.
How much difference it makes
The clearest public numbers come from research Google published in 2019 with New York University and the University of California, San Diego. Studying hijacking attempts against Google accounts, the team reported that an SMS code sent to a recovery phone number helped block 100 percent of automated bots, 96 percent of bulk phishing attacks and 76 percent of targeted attacks.
On-device prompts, where your phone asks “Is this you trying to sign in?”, did better still: 100 percent of bots, 99 percent of bulk phishing and 90 percent of targeted attacks.
Those figures come from one large provider’s systems at one point in time, so treat them as a strong indication rather than a guarantee. They show the scale of the gain: most account takeovers rely on a stolen password, and a second factor stops most of those attempts cold.
Most account takeovers start with a stolen password. A second factor stops most of them.
The main methods, from weakest to strongest
Not all second factors offer the same protection. Here they are in rough order.
| Method | How it works | Strengths | Weaknesses |
|---|---|---|---|
| SMS text code | A six-digit code by text message | Works on any phone; easy | Vulnerable to SIM-swap fraud and phishing |
| Email code | A code sent to your inbox | Easy | Only as safe as your email account |
| Authenticator app | An app generates a new code every 30 seconds | Works offline; no SIM risk | Codes can still be phished |
| Push prompt | Your phone asks you to approve the sign-in | Fast; shows location | “Prompt bombing” can trick tired users |
| Passkey or hardware key | Cryptographic login tied to the real website | Resists phishing | Needs a compatible device or key |
Why phishing resistance matters
A fake login page can ask for your password and then your six-digit code, and pass both to the real site in real time. Codes from text messages and apps can be stolen this way. CISA describes FIDO/WebAuthn authentication, the standard behind passkeys and hardware security keys, as the only widely available phishing-resistant option, because the key will only respond to the genuine website.
What about push prompts?
CISA also warns about attackers flooding people with push requests until one gets approved by mistake. If your service offers number matching, where you type a number shown on the login screen into the app, switch it on.
Which accounts to protect first
You do not need to do everything today. Start with the accounts that give access to the others.
1. Your main email
Email is the master key. Almost every other account can be reset through it, so an attacker with your inbox can take the rest. Protect it first, and with the strongest method it supports.
2. Your password manager
If you use one, it holds everything. Use an authenticator app or a hardware key, never SMS alone.
3. Banking and payments
Banks, PayPal and similar services usually offer 2FA, and many require it.
4. Work and cloud storage
Google Workspace, Microsoft 365, Dropbox and accounting software often hold client data and invoices.
5. Social media and domain registrar
A hijacked social account can be used to scam your contacts. A hijacked domain registrar account can take down your website and email in one move, which makes it a high-value target for any business owner.
Setting it up, step by step
The details differ, but the pattern is the same almost everywhere.
Install an authenticator app
Choose a reputable one from your phone’s official app store. Many password managers also generate codes.
Turn on 2FA in the account’s security settings
Look for “Two-step verification”, “Two-factor authentication” or “Sign-in security”. If passkeys are offered, set one up as well.
Scan the QR code
The app adds the account and starts generating codes. Enter the current code to confirm.
Save the backup codes
Most services give you a set of one-time backup codes. Print them or store them in your password manager. They are how you get back in if you lose your phone.
Add a second method
Where allowed, register a second phone, a hardware key or a passkey on another device, so a single lost or broken phone does not lock you out.
For small businesses and teams
If you run a small team, one compromised staff account can expose client data, payroll and invoices. Most business software lets an administrator require 2FA for every user, and this is worth doing before anything else on your security list.
Enforce it centrally
In Google Workspace, Microsoft 365 and most accounting and CRM tools, the admin console has a setting to require two-step verification for all users. Give staff a week’s notice and a short how-to, then switch enforcement on.
Use shared-account alternatives
Shared logins, such as one password for the company social media account, make 2FA awkward because the code goes to one person’s phone. Where the platform supports it, give each person their own login with appropriate permissions. Where it does not, store the shared account’s authenticator codes in a business password manager that supports team vaults.
Plan for departures
When someone leaves, remove their access and any devices registered as second factors on the same day. Review admin accounts every quarter.
Common objections, answered
- “It takes too long.” After setup, most services remember trusted devices, so you see the prompt only on new devices or after a set period.
- “I’ll get locked out.” Backup codes and a second registered method solve this; see the next section.
- “Nobody would target me.” Most attacks are automated and indiscriminate. Bots try stolen passwords against thousands of accounts at once, which is exactly the kind of attack Google’s research found 2FA blocks.
Avoiding lock-outs
The most common complaint about 2FA is getting locked out after changing phones. A few habits prevent it.
- Before you wipe or trade in an old phone, move your authenticator accounts to the new one. Many apps now offer encrypted backup or transfer.
- Keep backup codes somewhere you can reach without your phone.
- Keep your recovery email and phone number up to date on each important account.
- If you use a hardware key, register two and keep the spare somewhere safe.
Two-factor setup checklist
- Authenticator app installed
- 2FA on main email, with backup codes saved
- 2FA on password manager, using an app or hardware key
- Banking and payment accounts protected
- Work, cloud storage and accounting apps protected
- Social media and domain registrar protected
- Passkeys enabled wherever offered
- Number matching on for push prompts
- A second method registered on each key account
- Phone-change plan written down
Takeaway
Two-factor authentication is the single most effective step most people can take to protect their accounts. Google’s research found that even a basic SMS code blocked the large majority of hijacking attempts, and CISA says any MFA beats none. Start with email and your password manager, prefer passkeys or an authenticator app over text messages, and keep backup codes where you can find them.
