Quick answer: To set up two-factor authentication, go to the security settings on each important account, turn on two-step verification, and choose an authenticator app or a passkey as your second step. Start with your email, then banking, your Apple or Google account, and your social accounts. Save the backup codes somewhere safe. That last step is what stops you getting locked out.
Most account takeovers don’t involve a master hacker breaking encryption. They usually start with a password that was reused, guessed, or stolen in someone else’s data breach, then typed into the real login page. Two-factor authentication (2FA), also called two-step verification or 2SV, breaks that attack. Even with your password, a criminal still needs a second proof, and that proof usually lives on your phone. It’s the single most useful security change most people can make. It’s free, too, and the whole project in this guide takes less than an hour. For more protection guides, see our Cybersecurity section.
What 2FA is, in one minute
Logging in normally proves one thing: you know a secret, your password. 2FA asks for a second, different kind of proof:
- Something you have: your phone generating a code, a notification to approve, or a physical security key.
- Something you are: a fingerprint or face unlock, often used to approve the second step or to use a passkey.
The methods, from good to strongest
| Method | How it works | Verdict |
|---|---|---|
| SMS text code | A code is texted to your phone | Better than nothing; vulnerable to SIM-swap fraud |
| Email code | A code is sent to your inbox | Weak if the email account itself is unprotected |
| Authenticator app | App generates a new code every 30 seconds | Strong, free, works offline, and it’s the default recommendation |
| Push approval | You approve a sign-in prompt on your phone | Strong and convenient; only approve prompts you triggered |
| Passkey | Cryptographic key unlocked by face, fingerprint, or PIN | Strongest mainstream option; use it where it’s offered |
| Hardware security key | A USB or NFC key you plug in or tap | Strongest; worth $25 to $70 or £20 to £55 for high-risk users |
The UK’s National Cyber Security Centre makes the same point in its guidance on securing your important online accounts: turn on 2-step verification on all important accounts, because it helps stop criminals even when they know the password. Any 2FA beats none, but move up the table wherever an account gives you the choice.
The order that matters: secure these accounts first
1. Your email, before anything else
Your inbox is the master key to your digital life, because password resets for almost everything else land there. Protect it first, with an authenticator app or a passkey, and a unique password you don’t use anywhere else.
2. Your Apple ID or Google Account
These guard your phone, photos, backups, and often your saved passwords. On iPhone, Apple prompts most users into two-factor automatically. Check it’s on under Settings > your name > Sign-In & Security. For Google, follow the official steps to turn on 2-Step Verification: open your Google Account, go to Security & sign-in, select 2-Step Verification, and follow the on-screen steps, adding an authenticator app and backup codes as you go.
3. Banking and money apps
US banks and UK banks alike increasingly require app-based confirmation, which is 2FA by another name. Turn on every extra verification option your bank offers, including transaction alerts, biometric login, and payment confirmations, and never approve a prompt you didn’t start. UK readers, please note this too: your bank will never ask you to move money to a “safe account,” and a 2FA prompt for a payment you didn’t make is a red alarm, not a nuisance.
4. Password manager, then everything else
If you use a password manager, it holds every key you own, so protect it with the strongest method available, ideally a passkey or hardware key plus an authenticator. Then work down your list: Microsoft account, Amazon, PayPal and Venmo or their UK equivalents, Instagram, Facebook, TikTok, X, LinkedIn, and any work accounts.
Step by step: setting up an authenticator app (works almost everywhere)
- Install an authenticator app: Google Authenticator, Microsoft Authenticator, Apple Passwords, or a reputable independent app such as Authy, from the official app store only.
- On a computer, open the account’s website and find Settings > Security > Two-factor or Two-step verification.
- Choose “Authenticator app.” A QR code appears.
- In the authenticator app, tap +, scan the QR code, and the account is added.
- Type the app’s current six-digit code into the website to confirm.
- Save the backup or recovery codes the site now shows you. Print them or store them in your password manager, not in a photo and not in your email drafts.
- Repeat for the next account. Most accounts take under three minutes each.
Backup codes and recovery: the part everyone skips
Phones get lost, stolen, and dropped in water. Backup codes are how you get back in when yours does. Each major account offers one-time recovery codes at setup. Store them offline or in your password manager, and store a second copy with a trusted family member if the account really matters. In the US and UK alike, families routinely rescue each other this way, so agree it in advance.
- Never store backup codes in the same unprotected place as the password.
- Add a recovery email and phone number to important accounts, and keep them current.
- If you change phones, move your authenticator first: most apps offer transfer or export, so do it before you wipe the old phone.
- On Apple and Google accounts, consider adding a trusted contact or recovery contact for account recovery.
This is also the right moment to fix the password underneath it all: unique, long, and stored in a manager. 2FA protects a weak password better than nothing, but the real goal is the combination, a unique password plus 2FA. It’s the same layered approach we recommend across TechPure‘s security coverage.
Common mistakes that lock people out (or let criminals in)
- Approving a prompt you didn’t trigger. If a sign-in approval arrives while you’re not signing in, deny it and change the password. Repeated prompts are an attack, not a glitch.
- Sharing a code with “support.” No bank, tech company, HMRC, or IRS agent will ever ask for your 2FA code. Anyone who does is a criminal.
- Keeping SMS as the only method on your email. SIM-swap fraud targets exactly this. Use an app or passkey for email at minimum.
- Skipping backup codes and only discovering it with a dead phone at an airport.
- Turning 2FA on, then reusing the password anyway. Layers only work when each one is real.
What we have seen go wrong, and how to avoid it
The problems we see most often aren’t technical. People turn 2FA on in a rush, close the tab, and never save the backup codes. Then the phone changes, the app doesn’t carry over, and a simple login turns into a long recovery process. We’ve learned to slow down at that one screen. Save the codes, check where you’ve stored them, and only then move on to the next account.
The other habit that causes trouble is approving prompts on autopilot. It’s easy to tap approve just to clear the screen, especially if prompts pop up often. We tell people to treat every prompt like a knock at the door. If you didn’t try to sign in just now, don’t approve it. Pause, deny it, and check the account properly. That small pause prevents a lot of avoidable stress.
Frequently Asked Questions
What is the difference between 2FA, two-step verification, and MFA?
They describe the same idea with slightly different labels. Manufacturers and banks use the terms interchangeably: proving your identity with more than just a password. The UK’s NCSC says 2SV, Google says 2-Step Verification, and your US bank may say MFA. The name doesn’t matter. Just turn it on.
Should I use SMS codes or an authenticator app?
Use an authenticator app wherever one’s offered. SMS codes can be intercepted through SIM-swap fraud, where a criminal convinces a carrier to move your number to their SIM. Keep SMS only as a backup method, and use app codes, push approvals, or passkeys day to day.
What happens if I lose my phone?
You sign in with a backup code, then set up 2FA again on the new phone and generate fresh codes. That’s exactly why saving backup codes during setup matters. If you skipped them, account recovery through the provider is still possible, but it’s slower and may require ID checks.
Are passkeys a replacement for 2FA?
In practice, largely yes. A passkey combines something you have, your device, with something you are, biometric unlock, in a single phishing-resistant step. Where a service offers passkeys, use one, and keep 2FA and a strong password on the account as well if it still has a password, as UK guidance recommends.
Final Takeaway
One hour, once, protects almost everything you do online. Email first, then your Apple or Google account, then money, then the rest, with an authenticator app or passkey everywhere and backup codes saved somewhere safe. Start now, and if a family member in the US, UK, or anywhere else still logs in with one reused password, send them this guide. More step-by-step protection is in our Cybersecurity section, and if you run a website yourself, our AI Overviews checklist shows how to protect and grow that too. Questions? Contact TechPure.
