Turn On Two-Step Verification
The single best thing you can do to stop your accounts being hacked takes about three minutes per account. Here's how to set it up on the accounts that matter most.
A stolen password stops being enough
Two-step verification (also called two-factor authentication or 2FA) means signing in needs your password and something only you have, usually your phone. Even if your password leaks, nobody else can get in. Turn it on for your email first: it's the key to resetting every other account.
SET UPTurn it on for your main accounts
Start with your email account, then work down.
- Go to myaccount.google.com/security.
- Under How you sign in to Google, choose 2-Step Verification and follow the prompts.
- Google sends a prompt to your phone each time you sign in somewhere new; tap Yes to approve.
On iPhone, go to Settings › your name › Sign-In & Security › Two-Factor Authentication and turn it on. Most Apple Accounts already have it, and new ones require it.
- Go to account.microsoft.com/security and sign in.
- Choose Manage how I sign in, then Turn on two-step verification.
- The free Microsoft Authenticator app makes approvals one tap.
Look in each account's Security, Privacy or Login settings for “two-step”, “2FA” or “two-factor”. Do these next: banking apps, Facebook, Instagram, WhatsApp, Amazon, PayPal, and your mobile carrier account.
WhatsApp: Settings › Account › Two-step verification sets a PIN that stops someone taking over your number.
When you turn on 2FA, most sites offer backup codes: one-time codes that get you in if you lose your phone. Print them or save them in a password manager, not just on the phone itself.
Also add a second method where you can, like a backup phone number or a security key.
Search “[site name] two-factor authentication” for its help page. A few sites don't offer it yet; use a strong, unique password there.
FAQCommon questions
Which method is safest: text message, app, or key?
An authenticator app or a passkey/security key is safest. Text-message codes are much better than nothing, but can be intercepted through SIM-swap scams.
What happens if I lose my phone?
Use your backup codes or backup method to sign in, then remove the old phone. That's why saving backup codes matters.
Do I have to enter a code every time?
No. Most services remember trusted devices, so you'll only be asked on new devices or occasionally.
What are passkeys?
A newer way to sign in using your phone's face or fingerprint unlock instead of a password. They can't be phished. Turn them on wherever they're offered.