Enabling two-factor authentication is covered elsewhere. This article is about the two decisions people get wrong: which method to use, and what happens when you lose access to it.
The methods, weakest to strongest
SMS codes
Better than nothing, and worse than everything else here. A code sent by text can be intercepted by SIM swapping, where an attacker persuades a mobile carrier to move your number to their device. It also fails when you have no signal or are travelling. Use it only if nothing else is available.
Authenticator app codes
A six-digit code that changes every thirty seconds, generated on your device from a shared secret. No network needed, nothing to intercept in transit. This is the sensible default for most people.
The code depends on the clock. If your codes are always rejected, the device's time has drifted — enable automatic time synchronisation.
Hardware security keys
A physical device you touch to approve a login. The strongest option, and the only one that is genuinely resistant to phishing: the key verifies the site's real address before responding, so it will not authenticate to a lookalike domain even if you are fooled.
Buy two. Register both. Keep one somewhere else. A single key is a single point of failure.
Backup codes: the part everyone skips
When you enable two-factor, you are given a set of one-time recovery codes. They exist for the day your phone is lost, stolen, replaced or reset.
Store them properly:
- Not on the same device that generates your codes. A phone that is lost takes both with it.
- In your password manager, or printed and kept somewhere physically secure. Both is better.
- Where a colleague can reach them if you are unavailable, if the account is a business one.
Each code works once. Cross them off as you use them, and generate a fresh set when they run low.
Before you replace a phone
This is where most lockouts happen. Authenticator secrets do not always move with a standard device backup, and factory-resetting the old phone destroys them.
The order that works: set up the new phone, move or re-enrol every authenticator entry, verify you can generate a working code for each account, and only then wipe the old device. Not the other way round.
If you are locked out
Use a backup code. If you have none, we will need to verify that you own the account before we can help, and that process is deliberately slower and more demanding than logging in normally — it has to be, because the same process would otherwise be an attacker's route in. Open a ticket from an address already on the account and expect to answer questions.
Where you should also turn this on
Your email account first, before anything else. Email is the reset channel for everything else you own, so an attacker with your mailbox does not need any of your other passwords. Then your domain registrar, your banking, and this portal.
