Two-factor authentication (2FA) is the single highest-impact security step you can take. It blocks the vast majority of account takeovers — even if a hacker has your password, they can’t get in without your second factor. Setting it up takes about 3 minutes per account, and the accounts that matter most number fewer than ten.
Here’s the priority order (do them in this sequence), how to choose between authenticator apps, SMS codes, and passkeys, and the backup steps that prevent 2FA from locking YOU out.
Set These Up First (Priority Order)
1. Your email (Gmail, Outlook, iCloud). Your email resets every other password — it’s the master key. If you do nothing else in this article, do this one.
2. Your Apple ID / Google account. These control your devices, photos, location, and purchase history.
3. Your bank and financial accounts. Most banks now require or strongly push 2FA — let them.
4. Password manager. Your vault holds everything; it needs the strongest protection.
5. Social media (especially Instagram and Facebook — the most hijacked accounts). Enable 2FA plus login alerts.
6. Everything else as you encounter it. Shopping, cloud storage, work accounts — enable it when you log in next.
Authenticator App vs SMS vs Passkeys
Authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) are the sweet spot: free, work offline, and immune to SIM-swapping attacks. This is what you should use for most accounts. Pro tip: Authy syncs encrypted backups across devices — if you lose your phone, you don’t lose all your codes. Google Authenticator now backs up to your Google account too.
SMS codes are better than nothing but the weakest option. SIM-swapping (a scammer convinces your carrier to move your number to their SIM) defeats SMS 2FA. Use SMS only when it’s the only option offered.
Passkeys are the future and increasingly the present. They’re phishing-proof (they only work on the real site), faster than typing codes, and built into iOS, Android, Windows, and Mac. When Google, Apple, or Microsoft offers ‘create a passkey,’ say yes — then keep your authenticator as backup.
Hardware keys (YubiKey, $25-$55) are the gold standard for high-risk people — journalists, executives, crypto holders. Overkill for most, but the most secure option that exists.
How to Actually Enable It (The Pattern)
The steps are nearly identical everywhere: Account Settings > Security > Two-factor authentication (or 2-Step Verification) > Get Started. You’ll scan a QR code with your authenticator app, enter the 6-digit code to confirm, and you’re done.
Gmail: myaccount.google.com > Security > 2-Step Verification. Apple: Settings > [your name] > Sign-In & Security > Two-Factor Authentication (on by default for new accounts). Microsoft, Facebook, Instagram, Twitter/X: all under Settings > Security. It takes longer to find the menu than to complete the setup.
Don’t Lock Yourself Out: Backup Steps
Save your backup/recovery codes. Every service gives you 8-10 one-time codes during 2FA setup — screenshot them, print them, store them in your password manager. These are your lifeline if you lose your phone.
Register TWO second factors where possible: authenticator app + backup codes minimum. For critical accounts (email, bank), add a second device or a hardware key.
Use an authenticator with cloud backup (Authy, or Google Authenticator with sync enabled). The #1 2FA disaster is ‘I got a new phone and lost all my codes.’ With backup enabled, signing into the authenticator on the new phone restores everything.
If you change phone numbers, update your 2FA settings BEFORE canceling the old number. SMS-based 2FA tied to a dead number is a common lockout cause.
What About All Those Other Accounts?
You don’t need 2FA on your pizza loyalty account. Focus on: anything with money, anything with your identity (email, government, health), and anything with an audience (social media). For the rest, a strong unique password in a password manager is sufficient.
And enable login alerts everywhere offered — an email or push notification for new sign-ins catches the attempts that 2FA blocks, so you know to change that password.
2FA for Families: Protecting Everyone
You’re only as secure as your least-secure family member — hackers target grandparents and kids specifically. The family rollout: set up authenticator apps on everyone’s phones YOURSELF (don’t explain it — do it during a visit), save everyone’s backup codes in YOUR password manager (or a sealed envelope), and enable login alerts everywhere.
For kids: 2FA on their Apple/Google accounts, Roblox, Fortnite, and social media (gaming accounts are prime targets — rare skins sell for real money). For seniors: 2FA on email and bank, with backup codes printed and stored safely (not on a sticky note on the monitor — in a drawer, or with you). Our parental controls and hacked email guides complete the family security picture.
One afternoon securing the family’s accounts prevents the 11 PM ‘I think I got hacked’ panic call. Do it at the next family gathering — make it a group activity, not a lecture.
What to Do When You Lose Your Phone (2FA Recovery Drill)
The scenario everyone fears: phone lost/stolen with all 2FA codes on it. The drill, in order: 1) Use backup codes (you saved them, right?) to log into your email on another device. CISA’s MFA guidance covers the why behind each step. 2) Remote-wipe the lost phone (Find My iPhone / Find My Device — do this within hours). 3) In your authenticator app’s cloud backup (Authy/Google Authenticator sync), restore codes to the replacement phone. 4) For accounts without backup access, use each service’s account recovery (ID verification — slow but works). 5) Call your carrier to freeze the number (prevents SIM-swap exploitation of the loss).
Prevention checklist (do TODAY): authenticator with cloud backup enabled, backup codes saved for email/bank/Apple/Google, Find My enabled, carrier PIN set (prevents unauthorized SIM changes), and a spare old phone that can receive codes in emergencies. The people who survive phone loss calmly are the people who prepared boringly. Be boring.
Test it once: borrow a family member’s phone, try logging into your email with a backup code. If it works, your recovery plan is real. If it doesn’t, you found the gap before the crisis. Five minutes of testing beats five hours of panic.
The Bottom Line
Start with your email — 3 minutes, biggest impact. Then Apple/Google, bank, password manager, social media. Use an authenticator app (not SMS), save your backup codes, and say yes to passkeys when offered. An afternoon of setup buys you permanent protection against the most common way accounts get stolen. There’s no security step with a better effort-to-protection ratio.