Setting Up Two-Factor Authentication
2FA is your strongest defence against account takeover. This is how to set it up correctly.
Two-factor authentication (2FA) means even if someone steals your password, they still cannot get into your account without a second code that only you can generate. It is one of the most effective security measures available — and it is free.
Understand the two types of 2FA
SMS 2FA sends a code to your phone via text message. Authenticator app 2FA generates a code directly on your device. SMS 2FA is better than nothing but can be defeated by SIM swap attacks. Authenticator app 2FA is significantly stronger and is what we recommend.
Download an authenticator app
Install Google Authenticator or Authy from the official Google Play Store or Apple App Store. Do not download authenticator apps from links sent to you — always go directly to the app store. Both apps are free.
Enable 2FA on your most important accounts first
Start with: your primary email account, your mobile banking app, your social media accounts, and any platform where money is stored. In the security settings of each account, look for 'Two-factor authentication' or '2-step verification' and follow the setup steps.
Scan the QR code and save your backup codes
When setting up 2FA, the service will show you a QR code. Scan it with your authenticator app. The app will then generate a 6-digit code that changes every 30 seconds. The service will also give you backup codes — print these and store them somewhere physically safe. These are for emergencies.
Test it before you rely on it
After setting up 2FA, log out of the account and log back in. Confirm the 2FA code prompt appears and that your authenticator app generates the correct code. Do this for every account you protect.
Key Reminders
Never share your 2FA code with anyone — not even someone claiming to be from customer support.
If you lose your phone, backup codes are the only way to recover access. Keep them safe.
If a service only offers SMS 2FA and you are concerned about SIM swap, that is still better than no 2FA at all.
In this guide
- Understand the two types of 2FA
- Download an authenticator app
- Enable 2FA on your most important accounts first
- Scan the QR code and save your backup codes
- Test it before you rely on it
Quick Actions
Browse all protection guides
All Guides