Two-factor authentication blocks the overwhelming majority of account takeovers, and setting it up well takes five minutes per account. The order to do it in, and the recovery step everyone skips.
Quinn Yoo
Passwords leak constantly - through breached sites, reused credentials, and phishing - and a leaked password is usually tried on your email, bank, and socials within hours. A second factor means the password alone is worthless: the attacker also needs something you physically have. That single change defeats the bulk auto-login attacks that drive most account takeovers.
Prioritize by blast radius: email first (it is the master key - password resets for everything else flow through it), then banking and payment apps, then the main socials and your password manager. Five accounts cover most people's real risk.
SMS codes are far better than nothing but are the weakest form: they fail with no signal, and they are stealable via SIM-swap attacks (an attacker convinces your carrier to move your number) and phishing pages that relay the code in real time. Use SMS only where it is the sole option.
Authenticator apps (Google Authenticator, Microsoft Authenticator, Authy, or your password manager's built-in TOTP) generate codes on-device - nothing travels over the phone network, so there is nothing to SIM-swap. This is the right default for most accounts. Above that sit passkeys and hardware security keys, which are phishing-proof: they cryptographically verify the real site, so even a perfect fake login page gets nothing. Where a service offers passkeys (Google, Apple, Microsoft, and most majors now do), take them.
In each account's security settings, choose two-step verification -> authenticator app, scan the QR code with your authenticator, and type back the 6-digit code to confirm. Two upgrades while you are there: remove SMS as a fallback where the service allows (a fallback is an attack path), and add a second method - a passkey, or the authenticator on a partner's device for shared accounts.
Critically: when the service shows backup codes - the one-time recovery codes, usually ten of them - actually save them. Password manager's secure notes, or printed and stored with your documents. This screen appears exactly once, and it is the difference between a five-minute recovery and a multi-week support ordeal when your phone dies.
Your second factor lives on a device that will eventually be lost, broken, or upgraded. Three preparations make that a non-event: enable your authenticator's sync or cloud backup (Google Authenticator syncs to your Google account if signed in; Authy syncs by design; iCloud Keychain syncs its codes across Apple devices), keep those saved backup codes current, and register a second factor device where it matters most - a hardware key in a drawer, or a second phone/tablet enrolled.
When you upgrade phones, transfer the authenticator BEFORE wiping the old one - every major authenticator has an export/transfer flow (Google Authenticator: Settings -> Transfer accounts). The classic disaster is trading in a phone with the only copy of twenty 2FA seeds on it.
App-based codes defeat password-stuffing but not live phishing: a fake login page can ask for your code and relay it to the real site within its 30-second window. The tells: 2FA prompts you did not initiate, urgency ('verify now or lose access'), and login pages reached from links rather than your own bookmarks. Never approve a push notification for a login you did not just attempt - 'MFA fatigue' attacks count on you tapping yes to make the buzzing stop.
This residual risk is exactly what passkeys and hardware keys eliminate, which is why the order of upgrades is: something everywhere (even SMS), apps where possible, passkeys on the accounts that would actually hurt - email, money, and the password manager itself.
You log in with your saved backup codes, or with the synced copy on another device, then re-enroll the new phone. With neither, you face each service's account-recovery process - days to weeks. This is why saving backup codes at setup is non-negotiable.
Yes - SMS 2FA still blocks the vast majority of automated takeovers, and an account with SMS 2FA is much safer than one with none. It is the floor, not the ceiling: upgrade to app codes or passkeys on accounts that matter.
A passkey is a cryptographic credential stored on your device that signs you in with your fingerprint, face, or PIN - no password typed, nothing reusable to steal, and it only works on the genuine site, making phishing structurally impossible. Where offered, it can replace both the password and the code.
It is a reasonable trade for most people: one well-secured vault (long master passphrase, its own 2FA via hardware key or separate authenticator) with passwords and TOTP codes together is far better than weak 2FA everywhere. Purists keep them separate; pragmatists value that the manager autofills both and is always backed up.
