Two-Factor Authentication, Explained: Codes, Apps and Passkeys
"Two-factor" sounds like something only IT people should have to think about. It isn't. It's the single biggest upgrade you can make to your accounts, it takes about five minutes per account, and it's the difference between "someone has my password" being a disaster and being a shrug.
A password is something you know. Two-factor authentication (also called 2FA, two-step verification or multi-factor) adds something you have, like your phone, or something you are, like your face or fingerprint. Someone who steals your password still can't get in without that second piece.
The kinds, from best to "better than nothing"
| Method | How it works | How safe |
|---|---|---|
| Passkey | You sign in with Face ID, a fingerprint or your device PIN. No password to type, so none to steal. | Best. It only works on the real website, so a fake login page can't trick it. |
| Security key | A small USB or tap-to-phone key you plug in or tap. | Best. Same technology as passkeys, in your pocket. A great backup. |
| Authenticator app | An app makes a fresh 6-digit code every 30 seconds. Apple Passwords, Google Authenticator, Microsoft Authenticator, Bitwarden and 1Password all do this. | Good. Stops most attacks, but a convincing fake login page can still get you to type the code. |
| "Is this you?" prompt | A pop-up on a phone or computer you're already signed into. | Good, as long as you only approve it when you just tried to sign in. Some make you match a number, which helps. |
| Text or phone-call code | A code sent by text message or a call. | Better than nothing. Texts can be phished, and a stolen phone number (see below) sends your codes to someone else. The federal cybersecurity agency (CISA) calls text and voice codes a last resort. |
If a site only offers text codes, turn them on anyway. Better than nothing is still a lot better than nothing.
Start with these accounts
- ☐ Email (all of them)
- ☐ Apple Account, Google account, Microsoft account
- ☐ Your password manager
- ☐ Bank, credit cards, PayPal, Venmo, Cash App
- ☐ Phone carrier account
- ☐ Social media, especially if it's your business page
- ☐ Business tools: Square, Google Business Profile, your domain and website host, your online store
Where to find it: usually in the account's settings under Security, Sign-in & security or Password & security. Look for Two-step verification, Two-factor authentication, 2FA or Passkeys.
Passkeys, the short version
Passkeys are where everything is headed. Google, Microsoft and Apple all support them, and Microsoft now makes new accounts passwordless by default. When a site offers to Create a passkey, say yes. It saves to whatever you use for passwords (Apple Passwords, Google Password Manager, Bitwarden and 1Password all hold passkeys) and syncs to your other devices.
- Google account: go to your Google Account, open Security, and look for Passkeys.
- Microsoft account: in your Microsoft account's Security settings, look for sign-in options and add a passkey.
- Everywhere else: watch for the "Create a passkey" or "Sign in faster next time" prompt and take it.
Keep your password too, for now. Plenty of sites still use it as a fallback.
Don't lock yourself out
The most common two-factor problem we fix isn't a hacker. It's someone locked out of their own account after a lost, broken or replaced phone. Do these four things and you won't be that person:
- Save the backup codes. Most sites hand you a set of one-time codes when you turn on 2FA. Print them or save them in your password manager. Not in your email, since that might be the account you're locked out of.
- Add a second way in. A security key, a second device that's signed in, or a trusted phone number.
- Keep your recovery email and phone number current.
- Getting a new phone? Move your codes before you wipe the old one. Codes saved in Apple Passwords, Bitwarden or 1Password move with your account. Google Authenticator and Microsoft Authenticator can back up to your account if you turn that on. Our new phone checklist has the rest.
Lock down your phone number
If any of your accounts still use text codes, your phone number is a key. In a SIM swap, a scammer talks your carrier into moving your number to their phone, and your codes start going to them. All the big carriers now have free switches that block this. Turn them on in your carrier's app:
| Carrier | Turn on |
|---|---|
| Verizon | Number Lock and SIM Protection (My Verizon app) |
| T-Mobile | SIM Protection and Account Takeover Protection, also called Port Out Protection (T-Life app) |
| AT&T | Wireless Account Lock (myAT&T app) |
Also set an account PIN with your carrier. On a smaller carrier, search its app for "number lock" or "SIM protection," or call and ask for both a port-out block and a SIM-change block.
The one rule
No real company will call, text or email you asking you to read back a code they just sent you. Nobody. Not your bank, not Apple, not "the fraud department." If anyone asks for a verification code, it's a scam. Hang up. (More on that in how to spot a tech support scam.)
Want help?
We'll go through your important accounts with you, turn on two-factor and passkeys, save your backup codes somewhere smart and lock down your phone number, so you're protected and can still get in on your worst day. Book a session.