How to Turn On Two-Factor Authentication: The Order That Matters

Almost nobody turns this on everywhere. People turn it on somewhere, get bored, and stop - which is fine, as long as the somewhere is the right somewhere.

Two-factor authentication means a stolen password is not enough on its own. Someone also needs the second thing: a code, a tap, a key, your face. That is the whole idea, and it is a good one.

What follows is an order, a method table with sources behind it, and the honest limits.

Do this before you turn anything on

Set up the recovery route first. This is the step people skip, and it is the step that locks families out of their own accounts.

When a service offers you backup codes - usually eight or ten one-time strings - save them somewhere that does not depend on the phone you are about to make essential. A password manager works. A piece of paper in a drawer works. A screenshot in your camera roll does not, because the camera roll is on the phone.

Then ask the awkward question: if this phone fell in a river this afternoon, what would happen to this account? If the answer is “I would be locked out permanently,” you need a second factor on a second device, or codes on paper, before you continue.

For an older relative or a less confident family member, do the recovery step with them and write down where the codes live. Setting up the second factor takes five minutes. Recovering an account without a recovery route can take weeks.

Start with email, then money

Your email address is the reset route for nearly everything else. Somebody who controls it can request password resets on your other accounts and receive them. That makes it first, not because email is precious, but because it is the master key.

Then your bank and anything holding money - payment apps, brokerages, anywhere with a stored card.

Then the account that would be worst for you specifically if someone else read it. For most people that is a messaging app or a photo library, not a social network.

Everything else can wait for a rainy afternoon, and honestly may never happen. Three accounts done properly beats twenty done badly.

Which method to pick

There is an official answer to this, which is unusual for security advice. CISA - the US government’s cyber agency - publishes a table headed “MFA Forms, Strongest to Weakest.” Here it is, with CISA’s own notes on what each method survives.

Two things follow from reading it properly.

The gap between rows 1 and 2 is not about convenience. A code from an authenticator app is a real improvement on a text message, but it can still be phished: a convincing fake login page asks for the code, you type it, and the attacker uses it within the minute. A security key or passkey cannot be handed over that way, because it checks which website is asking. That is what “phishing-resistant” means, and it is why CISA puts a category boundary there rather than a step.

Row 4 is still a row. SMS is last, and CISA says last resort - but a text-message code on an account that currently has nothing is a straightforward improvement, and CISA also says plainly that “any MFA is better than no MFA.” Do not let the perfect method stop you turning on the available one.

What the standard actually says about text messages

You will read, often, that “NIST deprecated SMS.” It did not. The current guideline is NIST Special Publication 800-63B-4, published July 2025, which replaced the previous revision when that was formally withdrawn on 1 August 2025. Its position on sending codes over the phone network is that this is a restricted authenticator - permitted, with conditions. The document adds that NIST “may adjust the restricted status of out-of-band authentication using the PSTN based on the evolution of the threat landscape,” which is a standards body saying we are watching this.

“Restricted” comes with obligations on the service, not on you. A provider using it must “offer subscribers at least one alternative authenticator that is not restricted” and must “provide subscribers with meaningful notice regarding the restricted authenticator’s security risks.” So if a service offers you only SMS and nothing else, that service is out of step with the current federal guideline - which is useful to know when you are deciding how much of your life to keep there.

The method the standard does rule out is email. NIST’s wording is flat: “Email SHALL NOT be used for out-of-band authentication.” Codes sent to your inbox are not a second factor in any meaningful sense, because your inbox is usually protected by the same password the attacker already has. If a service offers email codes as its only option, treat that account as single-factor whatever the settings page calls it.

Where to actually click

Deliberately, this guide does not give you menu paths. Every provider moves them, and a guide full of stale click-throughs is worse than no guide.

The reliable route is the same everywhere: sign in on a computer, open your account’s security or password and security settings, and look for two-factor authentication, two-step verification, or login verification. They all mean the same thing. If you cannot find it, search the provider’s own help site for “two-factor” - their page will be current, and this one would not be.

When you are offered a choice, take the highest row on CISA’s table that the service supports and you will actually use daily. A method you turn off in a fortnight protects nothing.

What this does not stop

Worth being straight about, because the marketing around this is enthusiastic.

Two-factor authentication stops the most common attack there is - someone with your password from a breach, trying it on your accounts. CISA notes it “stops some of the common malicious cyber techniques, such as password spraying.”

It does not stop everything. CISA describes real cases where “the attacker asked for, and received, the employee’s username, password, and 6-digit MFA code” - a live phishing site relaying the code the moment it is typed. CISA’s own words: “these ‘MFA bypass’ attacks are not theoretical risks but are happening in the wild even against well-funded companies with excellent security staff.” That is the specific gap phishing-resistant methods close, and the reason CISA’s table has a top row.

And no authentication design protects against handing your credentials over on purpose. NIST says so in the introduction: the protections “are not intended to protect against willful disclosure of credential secrets by a subscriber.” Someone who talks you into reading out a code has not defeated the technology. CISA also says, on a page that carries no date, that using MFA makes an account “99% less likely to be hacked.” We quote it as CISA’s claim rather than as a measurement, because no study is cited alongside it.

Doing this for someone else

If you are setting this up for a parent, a grandparent or a child, three things make it stick.

Put the second factor on a device they already use every day. A security key in a drawer is not a second factor; it is a lost object waiting to happen.

Write down where the recovery codes are, on paper, in the place where that household keeps important paper. Not in a note on the phone.

And tell them, in advance and in plain terms, that no real bank, shop or government office will ever phone and ask them to read out a code. The technology is not the weak point in that scenario; the phone call is. That one sentence prevents more account takeovers than the choice between rows 2 and 3 of the table.

Related Articles

What to Do If Your Password Is Leaked

How to Set Up a Family Password Manager

How to Spot Phishing Emails and Texts

Related Resources

CISA - Implementing Phishing-Resistant MFA

the source of the ranking table

CISA - More than a Password

CISA’s public page on multifactor authentication

NIST SP 800-63B-4

Digital Identity Guidelines: Authentication and Authenticator Management