Digital Safety

Two-Step Verification: How to Set It Up and Which Method to Use

A step-by-step two-factor authentication guide — passkeys, authenticator apps, push prompts and SMS compared, account order, backup codes, and SIM swap protection.

A password alone stops almost nothing any more. Passwords leak in bulk from services that had nothing to do with you, and reuse does the rest. Two-step verification is the one change that closes most of that gap. This guide covers which method to choose, which accounts to do first, and the two ways people lock themselves out.

Advertisement

Before you startShort answer
Which account should I secure first?Your email. It is the master key — every other account can be reset through it.
Which method is best?A passkey or a hardware key, then an authenticator app, then a push prompt. SMS is the weakest and still far better than nothing.
What is the most common mistake?Turning it on without saving the backup codes, then changing phones.

Advertisement

Step 1 — Understand what it actually stops

Two-step verification does not make an account unbreakable. It closes one specific and very common route, and it is worth being clear about which.

  • It stops a leaked password being enough. When a password from an old breach is tried against your email, the second step blocks it.
  • It stops password reuse cascading. One compromised service no longer opens the others.
  • It does not stop you handing over a code. If someone on a call persuades you to read out the number, the protection is gone. No method survives that, which is why no legitimate caller ever asks.
  • It does not stop malware on your own device, which can read the screen the code appears on.

Advertisement

Step 2 — Choose a method, knowing the trade-offs

Four methods are in common use. They are not equivalent, and the differences matter most on your email account.

MethodStrengthWorth knowing
PasskeyStrongestUses your phone or laptop’s own unlock. Nothing to type, and nothing to read out to anyone, which is why it resists fake login pages.
Hardware security keyStrongestA physical key you tap or plug in. Excellent, and you need a second one as a spare.
Authenticator app codeStrongSix digits generated on your device, working offline. Not tied to your phone number, so a SIM swap does not touch it.
Push prompt ("Was this you?")GoodConvenient. The risk is approving one out of habit — read what it says before tapping yes.
SMS codeWeakestVulnerable to SIM swap and to having your number ported away. Still much better than no second step at all.

The practical recommendation: a passkey or an authenticator app wherever the service offers one, with SMS as a fallback rather than the main method.

Step 3 — Do the accounts in the right order

Securing a shopping account before your email is effort spent in the wrong place. Work down this list.

  1. Your main email account. Everything else resets through it, so it is the only account whose compromise compromises all the others.
  2. Your phone account, with your mobile operator. This is the one that prevents a SIM swap, and almost nobody does it.
  3. Banking and payment apps.
  4. Your messaging apps, which on most services is a separate PIN rather than a code — it stops someone registering your number on their own phone.
  5. Social accounts, which are where impersonation of you towards your contacts begins.
  6. Cloud storage, which usually holds your photos and documents.

Step 4 — Save the backup codes before you need them

Every service issues a set of one-time backup codes when you turn this on. They are shown once. This is the step people skip, and it is the reason most lockouts happen.

  1. Save them somewhere that does not depend on the phone you just secured. A password manager, or printed and kept with your documents.
  2. Do not photograph them into the gallery of the same phone. If the phone is lost, so are the codes.
  3. Do not email them to yourself — the email account is the thing they are protecting.
  4. Register a second method as well, so a lost phone is an inconvenience rather than a lockout.

Step 5 — Close the SIM swap route

If your second step arrives by SMS, then whoever controls your phone number controls your accounts. Taking a number over is a social-engineering attack on your mobile operator, not a technical one.

Someone contacts your mobile operator with enough personal detail to pass their checks — a name, a date of birth, an address, sometimes the last few digits of a payment method, all of which are widely available. They report the phone lost and request the number on a new SIM. Your phone loses service; their phone starts receiving your codes.

Step 6 — Before you change phones

A new phone is the other common way people lock themselves out, and it is entirely avoidable with five minutes of preparation.

  1. Move your authenticator entries first, while the old phone still works. Most authenticator apps have an export or transfer function built in.
  2. Check your backup codes are where you think they are, before wiping anything.
  3. Keep the old phone until everything is confirmed working, rather than trading it in the same day.
  4. Sign out of the old device from each account’s security page once the new one is set up.

Common questions

No. It is the weakest of the methods and it is still a very large improvement over a password alone. The right move is to add something stronger on the accounts that matter, not to turn SMS off and have nothing.

The six steps in one place

  • Know what it stops — leaked passwords and reuse, not a code you hand over.
  • Prefer a passkey or authenticator app; keep SMS as a fallback.
  • Email first, then your mobile account, then banking and messaging.
  • Save the backup codes somewhere independent of the phone.
  • Close the SIM swap route with a port-out PIN and by moving off SMS.
  • Transfer before you change phones, and keep the old one until it all works.

Related Posts