Two-Factor Authentication Explained: Set It Up Right
What two-factor authentication is, which method to choose, how to set it up on key accounts and how to avoid being locked out or tricked.
Two-factor authentication, often shortened to 2FA, adds a second step when you sign in. Even if a criminal learns your password, they still cannot get in without the second factor. It is one of the most effective security measures available, and it takes only a few minutes per account to turn on.
The idea in plain terms
Security people describe three kinds of proof:
- Something you know, such as a password or PIN.
- Something you have, such as a phone or a security key.
- Something you are, such as a fingerprint or face.
Two-factor means combining two different kinds. A password plus a code from your phone is the classic example.
The common methods compared
| Method | How it works | Strengths | Weaknesses |
|---|---|---|---|
| Text message code | Code sent to your mobile | Easy, no app | Can be intercepted or targeted by SIM swapping |
| Authenticator app | App generates changing codes | Stronger, works offline | Need to move it when changing phone |
| Push approval | Tap to approve on your phone | Convenient | Can be tricked by repeated prompts |
| Security key | Physical device you plug in or tap | Very strong against phishing | Cost, risk of losing it |
| Biometrics on device | Fingerprint or face | Fast | Tied to the device |
For most people, an authenticator app is a good balance. A text code is still much better than nothing.
Where to turn it on first
Prioritise accounts that would hurt most if taken over:
- Your main email, since it is used to reset everything else.
- Banking and finance apps and websites.
- Cloud storage and photo accounts.
- Your phone and device account.
- Social media and shopping accounts.
- Your password manager. See password manager guide.
Setting it up safely
- Open the account's security settings and look for "two-step verification" or similar.
- Choose an authenticator app or security key where offered.
- Scan the code or follow the prompts.
- Save the backup codes in a safe place, such as a printed copy or your password manager. These are your way back in if you lose the phone.
- Test by signing out and back in.
Avoiding lock-outs
The big risk of 2FA is losing the second factor. Reduce it by:
- Keeping backup codes safe.
- Adding a second method, such as a spare key or a phone number.
- Moving your authenticator app properly when upgrading phones, not just wiping the old one.
- Updating your recovery email and phone number.
Spotting tricks that target 2FA
Criminals know people have codes, so they try to trick you into handing them over.
- Never share a code with someone who calls or messages you, even if they claim to be your bank. A code is for you only. See what not to share.
- Be suspicious of unexpected prompts. If you did not try to log in, deny the request and change the password.
- Check the website address before entering a code, as phishing pages relay codes in real time. See spotting phishing emails and texts.
For older relatives and small businesses
A relative may find texts easier than an app, and that is fine as a starting point. Businesses should prioritise email and accounting accounts, as covered in small business IT basics.
Getting help
If setting it up on many accounts feels daunting, a technician can sit with you and do it step by step. On Compito you can search by postcode, compare ID-verified local providers and send a request. You receive an offer to accept and pay online and message the provider to agree the plan. See tech support services.
A worked example: the stolen password
Someone reuses a password from a shopping site that is later breached. Criminals try that email and password on a mail account. Without two-factor authentication, they would be in within seconds. With it, they hit the second step and fail, while the owner gets a prompt for a login they did not make. They deny it, change the password and carry on. The extra step took five seconds each time they signed in on a new device, and it stopped what could have become a chain of resets across their other accounts.
Choosing a method by situation
| You are... | A sensible choice |
|---|---|
| New to it, and anxious about complexity | Text message codes on important accounts to begin with |
| Comfortable with apps | An authenticator app on your phone |
| Protecting a business or very valuable account | A hardware security key, plus a spare |
| Often without signal | App or key rather than text |
| Sharing a device with others | Avoid push approvals that others could tap |
Changing phone without locking yourself out
- Before wiping the old phone, check how your authenticator app moves its codes. Some offer an export or backup feature.
- Set up the new phone and confirm the codes work for each account.
- Only then remove the old phone's entries.
- Update your backup codes if the account regenerates them.
Doing this in the wrong order is the most common way to lose access.
Mistakes to avoid
- Saving backup codes only on the phone that holds the authenticator.
- Approving a prompt you did not trigger "to make it stop".
- Using a phone number you no longer have as the only recovery method.
- Turning it on for one account and leaving email without it.
- Sharing codes with someone who rings up offering help.
When it will not work
Some older services have no second step, and some accounts are tied to a number that has changed. In those cases, contact the service through its official route, and use a strong unique password until the option arrives.
Frequently asked questions
Does 2FA make me completely safe?
No, but it blocks the great majority of simple account takeovers. Combine it with unique passwords and caution about links.
What if I lose my phone?
Use your backup codes or secondary method to regain access, then set up 2FA on the new phone. This is why backup codes matter.
Is a text message code good enough?
It is better than no second factor. If an app or key is available, they are stronger choices.