Two-Step Verification: The One Setting Worth Turning On

If you do one thing after reading our safety guides, do this. A password can be guessed, reused or stolen in a data breach. A second step stops most of those problems from turning into a taken-over account. This guide explains the choices and the steps, with CISA's description of how it works.

What is it?

Multifactor authentication, or MFA, is also called two-factor or two-step verification. Instead of a password alone, the login asks for another proof: something you know (the password), something you have (your phone or a key) or something you are (a fingerprint or face). CISA's page explains that MFA provides extra security by confirming your identity when you log in, “like entering a code texted to a phone or one generated by an authenticator app,” and that even if an unauthorized user steals your password, they will not be able to meet the second step.

It is a plain improvement. A thief who buys your password in a breach still cannot open the account.

Which kind should you choose?

CISA's list of methods: receiving a numeric code by text or email; using an authenticator app, a phone app that generates a new code every 30 seconds; and biometrics, such as facial recognition or a fingerprint. For the strongest protection, CISA points to phishing-resistant MFA, based on FIDO standards.

A practical order: phishing-resistant MFA where a service offers it, an authenticator app next, and a text code if that is all there is. A text code is better than nothing.

How do you turn it on?

CISA's steps: go to Settings, look under your account profile for Account Settings, Profile, Preferences, Privacy or similar, and open the security settings, which may be labeled Security or Password and Security. Look for and turn on MFA, which may be called two-factor authentication, two-step authentication or similar. Then confirm which method to use from the options offered. Allow ten minutes for your first account.

Save the backup codes the service shows you. Print them or store them in your password manager, because they are your way back in if you lose the phone.

Which accounts first?

Start with the accounts that unlock the others: your email, since password resets go there; your bank and card accounts; your phone carrier account; your password manager; and your Apple, Google or Microsoft account. Then social media, shopping and anything with stored cards. If you run a business, the FTC says to require multi-factor authentication to protect sensitive information. If you own a domain name, ICANN advises enabling multi-factor authentication at your registrar. See fake domain renewal notices.

Pair it with a good password manager; see passwords and password managers.

What can go wrong?

The common trouble is a lost or replaced phone. Before you retire a phone, move your authenticator app and test the codes on the new one. Keep the backup codes. Beware of a message that asks you to read back a code you received: legitimate services do not call you to ask for it. That is a scam, and it is how some accounts are taken even with two-step verification; see what to do after a phishing click.

Send your address through the check form before you settle on a provider. A person checks the path from the nearest tower and calls with the answer. Call 775-575-9593, 9 to 5 every day, if you want to talk it through.