Turn on two-factor authentication—and plan for a lost phone

A password is one piece of evidence that you should be allowed into an account. Two-factor authentication adds another type of evidence, often something you have, such as a phone or security key.

It is an important improvement, but the setup is not finished when the first code works. You also need to know how to get back in if the device disappears.

The second factor creates another barrier

A stolen password alone may no longer be enough to sign in. Depending on the service, the additional step could use an authenticator app, a text message, a security key or another supported mechanism.

These methods do not all resist the same attacks. Codes can be captured through phishing. Unexpected approval prompts can pressure someone into authorizing a login they did not start.

CISA recommends phishing-resistant methods where they are available. The strongest practical choice depends on what your service supports and what you can use reliably.

Protect the accounts that unlock other accounts

Start with your primary email, password manager and important work accounts. An email account often receives password-reset messages for other services.

Check the recovery email addresses and phone numbers associated with those accounts. Remove obsolete information through the genuine account settings.

Do not assume a rarely used recovery address is unimportant. It may provide a route around the protection you just enabled.

Save recovery material deliberately

Some services provide one-time recovery codes. Store them somewhere secure that remains available if your phone is lost.

A screenshot saved only on the same phone may not solve that problem. A suitable password manager or another secure, independently accessible location can be more useful, depending on your circumstances.

Treat recovery codes like credentials. Do not paste them into a chat or send them to someone claiming to offer support.

Test before removing the old method

When moving to a new phone or changing authenticator apps, follow the service's migration guidance. Confirm that the new setup works before wiping the old device.

For critical accounts, consider a supported backup authenticator or security key. Keep track of which account each method belongs to without exposing secrets.

Do not intentionally lock yourself out to test recovery. Review the process and perform ordinary sign-in checks while your existing access remains available.

Handle unexpected prompts as a warning

If a prompt appears for a login you did not initiate, deny it. Open the account through its official app or known address and review recent activity.

Repeated prompts are not a reason to approve one so they stop. They may indicate someone is trying to gain access or has obtained part of your sign-in information.

For work accounts, report the activity through the established security channel.

Keep the routine manageable

Choose a method you will actually use, then document recovery in a safe place. Recheck the setup when you replace a phone, change a number or stop using an email address.

Two-factor authentication reduces important risks. A sensible recovery plan helps you keep that protection enabled instead of abandoning it after the first inconvenient experience.