How to Set Up Two-Factor Authentication Properly

Anyone can enable 2FA. Doing it so you do not lock yourself out, or get phished anyway, takes a few extra minutes on the right five accounts.

Two-factor authentication is the highest-value twenty minutes you can spend on your accounts, and most people do it in the way that fails first: a text message code with no backup. The goal is a second factor that an attacker cannot obtain remotely and that you can still use if your phone dies.

Rank the methods

• Hardware security key or passkey: phishing-resistant, because the key checks the real site address. Best option where supported.
• Authenticator app with time-based codes: strong and widely supported, but a proxy phishing page can relay a code in real time.
• Push approval in an app: convenient, vulnerable to approval fatigue attacks. Only use it with number matching enabled.
• Email code: only as strong as the email account it goes to, so protect that account first.
• SMS code: the weakest option, defeated by SIM swap. Better than nothing, never the only factor on money accounts.

Setting up an authenticator app correctly

1. Install the authenticator app on your main phone, and a second one on a tablet or a spare device if it supports syncing.
2. Scan the QR code on the site's security page and confirm the six-digit code works before you close the window.
3. Write the recovery codes on paper immediately. Do not screenshot them and do not store them in the same password manager entry they unlock.
4. Check whether the site lets you enroll a second method or a second device, and do it now rather than after a phone replacement.
5. Store the recovery codes in two places, at least one offline, and confirm they are readable months later.
6. Test one code entry, log out, and log back in to prove the whole chain works end to end.

Where it goes wrong

• Losing the phone with no recovery codes. This is the most common way people lose access permanently.
• Replacing a phone without exporting or re-enrolling the authenticator. Move the secrets before wiping the old device.
• Accepting the browser prompt to remember the device forever on a shared or work machine.
• Enabling 2FA on fifty shopping sites and none on email. Your email account resets everything else.
• Falling for a proxy phishing page, then typing the code into the attacker's copy of the site.

Where the codes really get stolen

Modern attacks do not break the second factor, they relay it: a fake login page forwards your password and your code to the real site while you watch it work. That is why hardware keys and passkeys matter so much, and why a code typed into a page you reached by clicking a link is only as safe as the link. Add a password manager so each account has a unique password, and on exchange accounts turn on address whitelisting so a stolen session still cannot withdraw.

Do it in this order: email, password manager, bank, exchange, cloud storage. Five accounts, and everything else gets easier to recover.