How to set up two-factor authentication on your accounts

Technology · 6 min read

Passwords leak all the time, through data breaches, fake login pages and reused credentials. Two-factor authentication (2FA) means a stolen password alone is not enough to break into your account, because the thief also needs something that only you have. It takes a few minutes per account and is one of the best security upgrades you can make.

What 2FA actually does

Logging in normally uses one factor, something you know: your password. 2FA adds a second factor, usually something you have (your phone or a small key) or something you are (a fingerprint). Even if someone learns your password, they are stopped at the second step. Some services call it two-step verification or multi-factor authentication, and these all mean roughly the same thing.

Choose the right type of second factor

Not all methods are equally strong. Here is how they compare.

Method	How it works	Strength
SMS code	A code is texted to your number	Better than nothing, but SIM-swap fraud and message interception are possible
Authenticator app	An app on your phone generates a changing 6-digit code	Strong, works without network
Passkey or phone prompt	You approve a login with fingerprint or face	Very strong and resistant to fake sites
Hardware security key	A small USB or NFC key you tap	Strongest, good for high-risk accounts

For most people the practical order is: passkey if offered, then an authenticator app, then SMS only when nothing else is available. Common authenticator apps include Google Authenticator, Microsoft Authenticator and Authy, and password managers such as Bitwarden can also produce codes.

Which accounts to protect first

You do not need to do everything today. Start with the accounts that unlock all your others or hold money:

1. Your main email (Gmail, Outlook, Yahoo). Anyone who controls it can reset every other password.
2. Your Apple ID or Google account, since they hold photos, backups and your phone.
3. Banking, UPI apps and trading or demat accounts.
4. Social media, especially Instagram, Facebook and X, which are often hijacked to scam your friends.
5. WhatsApp, Amazon, and any shopping or cloud storage accounts with saved cards.

Turn it on for a Google account

1. Go to myaccount.google.com and open the Security tab.
2. Under "How you sign in to Google", choose 2-Step Verification and click Get started.
3. Sign in again, then add a phone prompt or an authenticator app.
4. Also set up a backup option, such as backup codes or a second phone number.
5. Consider creating a passkey on the same page so you can sign in with your fingerprint or screen lock.

Turn it on for Apple, WhatsApp and Instagram

Apple ID

On an iPhone, open Settings, tap your name, then Sign-In & Security. Two-factor authentication is on by default for most modern Apple IDs, but check it is active and that your trusted phone number is current.

WhatsApp

Open Settings, then Account, then Two-step verification and tap Turn on. Set a six-digit PIN and add an email address for recovery. WhatsApp will occasionally ask for the PIN, so do not forget it. Never share the SMS registration code you receive; scammers often ask for it.

Instagram and Facebook

Go to Settings, then Accounts Centre, then Password and security, then Two-factor authentication. Choose your account and pick an authentication app rather than text message where possible.

Set up an authenticator app

1. Install your chosen authenticator app from the official app store.
2. In the account's security settings, choose the authenticator option. A QR code appears on screen.
3. Open the app, tap Add, and scan the QR code. A 6-digit code appears and refreshes every 30 seconds.
4. Type the current code into the website to confirm, then save the backup codes the site gives you.

Important: Before you buy a new phone or reset the old one, move your authenticator accounts across. Apps like Microsoft Authenticator and Authy offer cloud backup or transfer features. If you skip this, you can be locked out of every account at once.

Avoid getting locked out

• Save backup codes. Print them or store them in a password manager, not in a notes app on the same phone.
• Add a second method. A backup phone number or a second device is handy if one fails.
• Keep recovery email and phone current. Old numbers cause the most lockouts.
• Know that support may not help. Some services cannot restore access if you lose every factor.

Watch out for 2FA scams

Attackers have adapted. A caller claiming to be from your bank who asks for the OTP is a scam, since no genuine staff member needs it. Be careful with fake login pages that ask for your code, and with "prompt bombing", where you get repeated approval requests at night hoping you tap Yes by accident. If you receive a code you did not request, someone knows your password: deny it and change the password right away. Report banking fraud quickly to your bank, and in India to the 1930 cyber crime helpline.

Final thoughts

Start with your email and money accounts, prefer an app or passkey over SMS, and store backup codes safely. Ten minutes of setup now can save weeks of recovery later. Once the habit is in place, signing in takes only a few extra seconds.