How to turn on two-step verification

A second lock on your accounts, so a stolen password isn't enough.

Last reviewed October 18, 2026 · See the sources · Download this guide (PDF)

What it is

Two-step verification asks for a second proof that it's really you after you enter your password. That might be a code, a tap on your phone, or your fingerprint. If a scammer steals your password, they still can't get in without that second step.

It goes by different names: two-factor authentication (2FA), multifactor authentication (MFA), or 2-Step Verification. They all mean the same thing.

Which kind to choose (best first)

1. A passkey or security key. The strongest choice. It can't be typed into a fake website, so it protects you even from convincing scam login pages. What are passkeys? →
2. An authenticator app. A free app on your phone that shows a new code every 30 seconds.
3. A code by text message, phone call, or email. The weakest option, because these codes can be intercepted or tricked out of you. But it's still much better than no second step at all.

Use the strongest option each account offers.

How to turn it on

1. Open the account's settings. Look for Settings, Account, or Profile, then Security, or Password and security.
2. Find two-step verification under any of the names above and turn it on.
3. Choose your method, then follow the prompts to finish.

Save your backup codes. Many accounts give you backup codes when you turn this on. Keep them in your password manager or print them and store them somewhere safe. They get you back in if you lose your phone.

Start with these accounts

• Your email. It's the key to resetting everything else.
• Your bank and payment apps.
• Your mobile phone account. See step 5 of the Starter Checklist for your carrier's protections.
• Your Apple or Google account, and your social media.

Official how-tos: Turn on 2-Step Verification (Google) · Two-factor authentication for Apple Account (Apple)

One rule to never break

Never share a verification code with anyone, even someone who says they're from your bank, Apple, Google, or "support." Real companies don't call to ask for your code. Anyone who asks is trying to get into your account.

A safety note. If you're in an abusive or stalking situation, the other person may notice new security settings. Make a safety plan first. Support is available, for example from the National Domestic Violence Hotline at thehotline.org.

Next step

Two-step verification works best with a strong, unique password.

Sources

Checked on October 18, 2026. Next review: by October 2027.

• Turn On MFA (CISA)
• Implementing Phishing-Resistant MFA (CISA fact sheet, PDF)
• Digital Identity Guidelines: Authentication, SP 800-63B-4 (NIST)
• Turn on 2-Step Verification (Google) · Two-factor authentication for Apple Account (Apple)

From beaponi.com/learn/two-step-verification · Last reviewed October 18, 2026 · General education, not professional advice.