How to Enable Two-Factor Authentication and Protect Your Accounts

Imagine someone discovers your email password. They could try to open your inbox, reset passwords for other websites and access personal information.

A strong password helps, but there is another simple step you can take: enable two-factor authentication (2FA).

It adds another layer of protection when you sign in. Here is what it means, how to set it up and what to do to avoid locking yourself out.

What is two-factor authentication?

Two-factor authentication asks you to prove your identity in two different ways when signing in.

For example, you might enter your password and then approve a notification on your phone. You could also use an authenticator app, a security key or a passkey, depending on the service.

This extra step makes it harder for someone to enter your account using only a stolen password.

You may also see it called two-step verification or multi-factor authentication (MFA). The names and setup options vary between services, but the goal is the same: make unauthorised access more difficult.

Which accounts should you protect first?

Start with accounts that could cause the most trouble if someone took control of them.

• Email: Someone with access to your inbox may be able to reset passwords for other accounts.
• Banking and payment services: Protect accounts that handle your money.
• Social media: Prevent someone from taking over your profile and impersonating you.
• Cloud storage: Keep personal files, photos and documents safer.
• Work and business accounts: Protect information belonging to you, your team or your customers.

If you can only secure a few accounts today, begin with your main email account and your most important financial accounts.

Step 1: Open your account's security settings

Sign in to the account you want to protect.

Look for a section called Security, Security and sign-in, Password and security or something similar. The exact wording depends on the website or app.

Look for an option labelled:

• Two-factor authentication
• Two-step verification
• Multi-factor authentication
• Passkeys or security keys

If you cannot find it, search the service's official help centre rather than following an unfamiliar link sent in a message.

Step 2: Choose a verification method

Different services offer different ways to confirm your identity. When possible, choose a method that offers strong protection against phishing.

Passkeys and security keys: These can provide strong protection against fake login pages. A passkey may let you sign in using your device's screen lock, fingerprint or face recognition.

Authenticator apps: These can generate temporary verification codes. Depending on the app and setup, you may be able to use them without an internet connection.

Sign-in approval notifications: Some services let you approve or reject a login request on a trusted device.

Text message codes: These are better than relying on a password alone, but can be vulnerable to attacks involving your phone number. Use a stronger available option when practical.

Follow the instructions shown by the service you are protecting. You may need to verify your identity or scan a QR code during setup.

Step 3: Turn on two-step verification for your Google Account

If you use Gmail, YouTube or other Google services, you can start here.

1. Open the official Google Account security page.
2. Select Security & sign-in.
3. Under How you sign in to Google, choose Turn on 2-Step Verification.
4. Follow the instructions and select a verification method.
5. Complete the setup and check that the feature is enabled.

Google may offer prompts, passkeys, authenticator codes and other verification options. Available methods depend on your account and device.

For detailed instructions, visit Google's official 2-Step Verification guide.

Step 4: Protect your Microsoft account

If you use Outlook, Windows or other Microsoft services, you can also enable two-step verification.

1. Visit the official Microsoft account security page.
2. Select the option to manage how you sign in.
3. Look for Two-step verification under the additional security settings.
4. Choose Turn on and follow the instructions.

The available sign-in and recovery methods can vary. Microsoft has also announced changes to SMS-based authentication for personal Microsoft accounts, so check the current options offered to your account.

For more information, read Microsoft's official two-step verification guide.

Step 5: Prepare for the day you lose your phone

Extra security is useful only if you can still get into your own account.

Before finishing the setup, check which recovery options the service provides.

• Save backup codes if the service offers them.
• Store them in a secure place separate from your everyday device.
• Add another trusted verification method if appropriate.
• Keep your recovery email and phone number up to date.
• Follow the service's official instructions for recovering access.

Never share verification codes or backup codes with someone who contacts you unexpectedly. A person asking for your code could be trying to take over your account.

Do not save backup codes in a public document or send them to yourself through an unprotected message.

Step 6: Test your setup

Once you have enabled two-factor authentication, make sure you understand how it works.

Sign in again when convenient and check that the expected verification step appears. Confirm that your recovery options are available and that you know how to use them.

If you use multiple devices, check that you can access the account from the devices you normally use.

For a work or school account, your organisation's administrator may control some of these options. Contact the administrator if you cannot enable the feature yourself.

Does two-factor authentication make you completely safe?

No. It reduces the risk of someone accessing your account with only your password, but no method is perfect.

Scammers can still try to trick you into approving a login or giving away a verification code. Keep using unique passwords, update your devices and be cautious with unexpected sign-in requests.

If a login approval appears when you are not trying to sign in, reject it and review your account's recent security activity.

Your account-security checklist

Before you finish, check that you have:

• Enabled two-factor authentication on your most important accounts.
• Chosen a verification method that suits your needs.
• Saved your recovery options securely.
• Confirmed that your recovery details are up to date.
• Learned how to report an unexpected sign-in request.

You do not need to secure every account in one sitting. Start with your email, then work through your other important accounts.

A few minutes of preparation today can make it much harder for someone to take over your accounts tomorrow.

Sources and further reading

• Google: Turn on 2-Step Verification
• Microsoft: How to use two-step verification
• CISA: Turn on multifactor authentication
• Google Account Security

Instructions and available security methods can change. Always follow the current guidance provided by the service you are protecting.