Quick answer
Two-factor authentication (2FA) adds a second step at login, usually a one-time code from an app or SMS. Enable it first on your email account, then on banking and social accounts, and save backup codes in a safe place. This prevents access even if your password leaks.
How to recognize the problem
- Someone is trying to sign in to your account from an unknown device
- You receive sign-in notifications even though you did not try
- Your password has appeared in a public data breach
- You want extra protection for email, banking, and social media
- Signing in with only a password feels insecure
Most common causes
Passwords are easily discovered
Passwords can be stolen through phishing, database leaks, or guessing. 2FA prevents sign-in even when an attacker has the correct password.
No second layer of protection
Without 2FA, just one stolen password is enough to take over an account. A second factor makes abuse much harder.
Insufficiently strong method
SMS codes are better than nothing, but authenticator apps and hardware keys provide greater security.
Backup codes are not saved
If you lose your phone or access to the app, without backup codes you may be locked out of your account.
Step-by-step fix
- 1
Make a list of accounts and priorities
First enable 2FA on the most important accounts: email (Gmail, Outlook), banking apps, social media, and cloud storage. Email is especially important because you can reset passwords for other accounts through it. Write down the accounts and the order in which you will secure them.
- 2
Install an authenticator app
Recommended apps include Google Authenticator, Microsoft Authenticator, or Authy. Install it on your phone from the official app store. The app generates codes that are valid for 30 seconds and does not require an internet connection.
- 3
Enable 2FA on your Google account
Go to
myaccount.google.com>Security, find2-Step Verificationand follow the instructions. Choose an authenticator app as the primary method and SMS as a backup. Save the backup codes. - 4
Enable 2FA on your Microsoft account
Go to
account.microsoft.com>Security>Advanced security options>Two-step verificationand turn it on. Then add a sign-in method via the Microsoft Authenticator app. Confirm your identity and save the recovery code. - 5
Enable 2FA on social media
On Facebook and Instagram: in
Settings, openAccounts Center>Password and security>Two-factor authentication. On X (Twitter):Settings and privacy>Safety and security>Security and account access>Security>Two-factor authentication. Choose an authenticator app instead of SMS where possible. - 6
Enable 2FA on banking apps
Banks often implement 2FA through their own app or SMS. Check in your bank's app settings whether 2FA is mandatory and how it is confirmed. If you are unsure, call the bank's customer support.
- 7
Save backup codes
During 2FA setup you will receive backup codes in case you lose your phone. Print them or save them in a password manager, not in a plain text file on your computer. Keep them in a place that is not accessible to others.
- 8
Test sign-in
Sign out of the account and sign in again using 2FA. Check that the code from the app works and that the backup codes are valid. If something does not work, resolve the issue before you lose access to your account.
Advanced 2FA tips
If you want the highest level of security, use a hardware security key (e.g., YubiKey) that supports FIDO2/WebAuthn. These keys are resistant to phishing because they are bound to the exact site domain. Also, always have two methods for 2FA: primary (app or key) and backup (SMS or backup codes). Regularly check active sessions and remove unknown devices. If you use a password manager, check whether it supports storing TOTP codes, but keep in mind that then everything depends on one password. For business accounts, an administrator can enforce 2FA and monitor who has not enabled it.
How to prevent it
- Enable 2FA on all accounts that support it, starting with email.
- Use an authenticator app instead of SMS wherever possible.
- Save backup codes in a safe place, separate from your phone.
- Regularly check that all your accounts are protected and that your passwords are strong and unique.
When to call a professional
If you have business accounts with multiple users or are unsure how to set up 2FA without interrupting access, contact IT support. They can help you configure 2FA properly and avoid lockout.
IT infrastructure maintenance · Servers, networks, backup, security and helpdeskFAQ
Is SMS 2FA secure enough?
SMS 2FA is better than nothing, but it is vulnerable to SIM swapping and interception. An authenticator app or hardware key is recommended as the primary method.
What if I lose the phone with the 2FA app?
Use the backup codes you saved during setup. If you do not have them, contact the service's support for account recovery.
Can I use the same app for multiple accounts?
Yes, apps like Google Authenticator or Microsoft Authenticator support multiple accounts at the same time. Each account has its own unique code.