The idea behind a second step
A password is something you know. Two-step verification adds a second check, usually something you have, such as your phone or a small hardware key, or something you are, such as a fingerprint. Even if someone learns your password, they still need the second item to get in.
You may also see it called two-factor authentication or multi-factor authentication. The names overlap in everyday use. What matters is that signing in takes more than one piece of proof.
The common methods
Methods differ in how convenient and how resistant to attack they are. From most basic to strongest, the usual options are as follows.
Codes sent by text message
The service sends a short code to your phone number, and you type it in. This is easy to set up and works on almost any phone, which makes it better than nothing. Its weaknesses are that text messages can be intercepted in some situations, and that attackers sometimes persuade a mobile carrier to move your number to a different SIM card. Codes can also be read off a lock screen, which is a reason to hide message previews.
Codes from an authenticator app
An authenticator app creates a code that changes every thirty seconds or so. The code is generated on your device instead of sent over the phone network, so it avoids the problems of text messages. This is widely regarded as a good balance of convenience and strength. The thing to plan for is losing the phone: if the app is not backed up and you have no backup codes, you could be locked out.
Approval prompts
Some apps send a notification to a signed-in device asking you to approve or deny a sign-in. These are convenient, but they can be abused. An attacker who has your password may trigger many prompts in the hope that you will tap approve just to make them stop. Only approve a prompt if you started the sign-in yourself, and deny and change your password if prompts arrive that you did not expect.
Security keys
A security key is a small physical device, or sometimes a built-in feature of your phone, that proves you are present. It is generally the strongest common option against phishing, because it works only with the genuine site. It does cost money, and you should have a spare in case you lose one.
Passkeys
Passkeys combine the password and second step into one phishing-resistant sign-in approved with your fingerprint, face or screen lock. They are not available everywhere yet, but where they are, they are a strong option. You can read about their limits in our look at passkeys and biometrics.
Which one should you choose
There is no single best answer for everyone. A rough ranking from the weakest to the strongest against common attacks is text codes, then authenticator app codes and approval prompts, then security keys and passkeys. But using any second step is considerably better than using none. If text codes are the only choice a service offers, turn them on rather than skip it.
A sensible approach is to start with the accounts that would hurt most to lose. Email comes first, since it is the route to resetting other accounts, followed by banking, payment apps, cloud storage and social media.
Setting it up well
- Save the backup codes the service gives you and keep them somewhere separate from your phone, such as a secure note in your password manager or a printed copy in a safe place.
- Add a second method if the service allows, such as a backup phone number or a second authenticator.
- Keep your phone number up to date with each service, and take care when you change carriers or phones.
- When you get a new phone, move your authenticator accounts across before wiping the old one, following the app’s instructions. A recent phone backup helps, but check whether your authenticator is included.
Where it can still fail
A second step is not a magic shield. The most common way around it is to trick you into handing the code over. A message that says your account is at risk and asks you to read out or reply with the code you just received is a scam; no genuine support team needs it. This is how app phishing often works, and the code is only for you to type in on a sign-in that you started.
Other weak points include a hijacked email account, harmful software on the phone, and approving prompts without thinking. Strong, unique passwords and an up-to-date phone remain part of the picture.
A short routine
Turn on the strongest method each service offers, store the backup codes, and avoid sharing codes with anyone. Review your second-step settings once or twice a year, remove old phone numbers, and make sure your recovery options are still correct.