How to Set Up Two-Factor Authentication (and Which Type to Pick)

Your password alone is a weak lock. Passwords get leaked in data breaches, reused across sites and typed into fake login pages every day. Two-factor authentication (2FA) adds a second check, so a stolen password is not enough for someone to get into your account.

The Federal Trade Commission calls 2FA the best way to protect your accounts, and the US Cybersecurity and Infrastructure Security Agency (CISA) says plainly that any multifactor authentication is better than none. The tricky part is choosing a method and not locking yourself out. This guide compares text codes, authenticator apps and security keys, then walks you through setup and backup codes step by step.

What two-factor authentication actually does

2FA asks for 2 different kinds of proof before letting you in. CISA groups them into 3 categories:

• Something you know: a password or PIN
• Something you have: your phone, an authenticator app or a physical security key
• Something you are: a fingerprint or face scan

A thief who buys your password from a breach still needs the second factor, which they usually do not have. You will also see 2FA called two-step verification, multifactor authentication (MFA) or login verification. They all mean roughly the same thing for everyday users.

The 4 main types of 2FA, compared

Not all second factors are equally strong. Here is how the common options stack up.

Text message codes

SMS codes are the most common and the easiest to set up. The FTC notes they are “better than nothing,” but warns that a SIM swap attack can let a criminal receive your texts. In a SIM swap, the attacker convinces your carrier to move your number to their SIM card. CISA has also advised against relying on SMS as a second factor where stronger options exist, because text messages are not encrypted.

The FCC adopted rules in November 2023 requiring wireless carriers to use secure authentication before moving a number to a new device or carrier and to notify customers about SIM change and port-out requests. That helps, but you can protect yourself further by adding a PIN or number lock to your carrier account.

Authenticator apps

An authenticator app, such as Google Authenticator, Microsoft Authenticator or the code feature built into many password managers, generates a fresh code on your phone every 30 seconds. Because the code never travels over the phone network, the FTC notes it is less exposed to SIM swaps. This is the best everyday choice for most people.

Push notifications

Some services send a prompt to your phone asking you to approve the sign-in. It is convenient, but attackers sometimes flood people with prompts hoping for an accidental tap. CISA recommends number matching, where you type a number shown on the login screen into your phone, to block this. Never approve a prompt you did not trigger.

Security keys and passkeys

A security key is a small USB or NFC device you plug in or tap. The FTC calls it the strongest option because there is no code for a scammer to steal. CISA identifies FIDO/WebAuthn as the phishing-resistant standard to aim for, and passkeys use the same technology built into your phone or computer. Read our guide to what passkeys are and how to use them if an account offers them.

Key takeaway: Use an authenticator app for most accounts, a passkey or security key wherever it is offered, and text codes only when nothing else is available. Whatever you pick, save your backup codes.

Which accounts to protect first

The FTC suggests starting with your most sensitive accounts and working outward. A practical order:

1. Primary email. It resets every other password, so it comes first.
2. Apple Account, Google Account or Microsoft account. These control your phone, backups and app purchases.
3. Bank, credit card and payment apps. Including PayPal, Venmo, Cash App and Zelle-enabled banking apps.
4. Tax and government accounts. For example, IRS online accounts and Social Security.
5. Social media. Hijacked profiles are often used to scam your friends.
6. Shopping, cloud storage and work tools. Anything with saved cards, files or customer data.

Running a small business? The same thinking underpins zero trust security, where every sign-in is verified rather than trusted by default.

How to set up 2FA: step by step

The menus differ, but nearly every service follows the same pattern. 2FA is usually off by default, so you have to switch it on.

1. Sign in on a device you own. Do this at home, not on a public computer.
2. Open the security settings. Look for “Security,” “Sign-in and security,” “Login and security” or “Privacy and security.”
3. Find the 2FA option. It may be labeled two-factor authentication, two-step verification, multifactor authentication or login approvals.
4. Choose your method. Pick an authenticator app, security key or passkey if offered. Use text messages only if they are the sole option.
5. Link your authenticator app. The site shows a QR code. Open your authenticator app, tap the add button, and scan it. Then type the 6-digit code the app shows to confirm it works.
6. Add a second method. Register a backup phone number, a second security key or another trusted device.
7. Save your backup codes. More on this below. Do not skip it.
8. Sign out and back in to confirm everything works before you close the settings page.

When the site asks whether to “remember this device,” the FTC advises only doing that on your own devices, never on a shared or public computer.

How to save and store backup codes

Backup codes, sometimes called recovery codes, are your emergency key. If you lose your phone, break it or switch numbers, a backup code gets you in. Google, for example, gives you a set of 10 eight-digit backup codes, and each code stops working once used. You can generate a fresh set at any time, which cancels the old set.

Good places to keep backup codes:

• A password manager, in the secure notes for that account
• A printed copy in a locked drawer, safe or with important papers
• A second trusted device that is not your everyday phone

Bad places: a screenshot in your camera roll, an unencrypted note on the same phone, or an email to yourself. If someone gets into that phone or inbox, they get your codes too.

Every few months, check that you still know where your codes are. When you use one, cross it off. When you run low, generate a new set.

What to do when you get a new phone

This is where most lockouts happen. Before you wipe or trade in your old phone:

1. Move your authenticator app first. Many apps now offer cloud backup or an export option. Turn it on, or move each account to the new phone while the old one still works.
2. Check your phone number. If you are changing numbers, update it in every account that sends text codes.
3. Test sign-ins on 2 or 3 key accounts using the new phone before resetting the old one.
4. Keep backup codes handy during the switch in case something does not transfer.

Our full guide on how to transfer data to a new phone covers the rest of the move.

Mistakes to avoid

• Sharing codes. No bank, tech company or government agency will call or text asking you to read back a verification code. Anyone asking is a scammer. If you already shared one, follow our checklist on what to do if you got scammed.
• Approving surprise prompts. If a sign-in request pops up and you did not just try to log in, deny it and change your password.
• Using one method only. If your only second factor is a single phone, losing it can lock you out of everything.
• Leaving weak carrier security. Add a PIN or port-out lock with your mobile carrier, and choose a random number rather than your birthday or ZIP code.

Where to start this week

You do not need a whole weekend. Set aside 30 minutes:

1. Install an authenticator app, or turn on the code feature in your password manager.
2. Turn on 2FA for your primary email, using the app or a passkey.
3. Save that account’s backup codes in your password manager and print a copy.
4. Repeat for your Apple, Google or Microsoft account and your main bank.
5. Call your mobile carrier or use its app to add an account PIN or number lock.

Then add 2FA to 1 or 2 more accounts each week until your list is done. New to security terms? Our glossary explains them in plain English.

Conclusion

Two-factor authentication is one of the simplest, cheapest security upgrades you can make. Pick the strongest method each account offers, starting with authenticator apps and moving to passkeys or security keys where available, and treat backup codes as seriously as your house keys. A few minutes of setup now can stop most account takeovers before they start.

Sources

• FTC Consumer Advice: Use two-factor authentication to protect your accounts — types of second factors, SIM swap risk, which accounts to protect first
• CISA: More than a password — factor categories, phishing-resistant MFA, number matching, “any MFA is better than no MFA”
• Google Account Help: Sign in with backup codes — 10 single-use backup codes and how to refresh them
• FCC: Protecting consumers from SIM swap and port-out fraud — November 2023 rules for carrier authentication and customer notifications