Two-factor authentication
Use two-factor authentication to reduce account takeover risk
Two-factor authentication (2FA) adds a second check when someone logs in. Even if a password is exposed in a breach, an attacker may still fail without the second factor, which is often a code from an authenticator app or a hardware device.
Recommended setup
- Enable 2FA on email and banking accounts first
- Prefer authenticator apps where available
- Store backup codes safely
- Review account recovery settings
Warning signs
- SMS-only 2FA on critical accounts
- Untrusted apps seeking account access
- Recovery phone numbers no longer controlled by the user