Two-Factor Authentication for Everyone: Plain-English Guide

A password on its own is no longer enough to keep criminals out of your email, bank or social media. Two-factor authentication (often shortened to 2FA, and also called two-step verification or 2SV) adds a second check when you log in, so a stolen password alone does not get someone in. This guide explains in plain English what 2FA is, which type to pick, how to switch it on for Google, Apple and Microsoft accounts, and what to do if you lose your phone. It is written for individuals, families, older people and very small businesses. For organisations, see the MFA Guide.

Key takeaways

2FA stops most stolen-password break-ins. Even if a criminal has your password, they still need the second check, which is usually on your phone.
Start with email. Your email can reset every other account, so protect it first, then banking, shopping and social media.
Any 2FA beats none. Text message codes are the weakest kind, but the US Federal Trade Commission (FTC) still calls them better than nothing.
Never share a code. No bank, shop or tech company will ask you to read out a code they sent you. Anyone asking is a scammer.
Plan for a lost phone today. Save backup codes or add a second phone number, or you could be locked out for weeks.

What two-factor authentication is, in plain words

When you log in, a website wants proof that you are really you. There are three kinds of proof:

Something you know: a password or PIN.
Something you have: your phone, a bank card reader or a small security key.
Something you are: your fingerprint or face.

Two-factor authentication asks for two different kinds. Usually that is your password plus a code or tap on your phone. It works like a house with two locks: a burglar who finds your front door key is still stuck at the second door.

You do not have to do the second step every time. The UK National Cyber Security Centre (NCSC) explains that once it is set up, you are usually asked only when something is unusual, such as a login from a new device or a request to change your password. Setting it up takes a few minutes per account.

2FA is usually switched off until you turn it on. In settings you may see it called two-factor authentication, two-step verification, 2-Step Verification, login approvals or multi-factor authentication (MFA). They all mean the same thing.

Which second step should you choose?

Most accounts offer more than one type. Here they are from weakest to strongest, based on FTC, NCSC and Google advice.

Type	How it works	Good points	Weak points
Text message (SMS) or email code	A six-digit code is sent to your phone or inbox. You type it in.	Simple. Works on any mobile phone, and some services can call a landline instead.	Criminals can steal your phone number by tricking your mobile company (a SIM swap). Anyone who gets into your email can read email codes.
Authenticator app	A free app on your phone (for example Google Authenticator or Microsoft Authenticator) shows a code that changes every 30 seconds or so.	Not tied to your phone number, so a SIM swap does not help a criminal. Works without signal.	If you lose the phone without a backup, you can get locked out.
Phone prompt	A message pops up on your phone asking "Is this you trying to sign in?" You tap Yes or No.	Very easy. Google recommends its prompts for most people.	Only tap Yes when you have just tried to log in yourself. Tap No to anything unexpected.
Passkey or security key	Your phone, computer or a small USB or tap-to-connect key confirms it is you, often with your fingerprint or face.	The strongest option. It will not work on a fake website, so it defeats most phishing.	A physical key costs money and you should buy two, keeping one as a spare.

Our simple advice: use whatever the account offers. If you can choose, an app, a phone prompt or a passkey is better than text messages. Some banks use a card reader or their own app, which the NCSC lists as valid second steps too. For more on passkeys, see the Passwordless and Passkeys Guide.

Set it up in 10 minutes per account

Do your email first, then banking and payment apps, then shopping and social media. Menus change from time to time, so if a setting has moved, look for "Security" or search the settings for "two-step" or "two-factor".

Google account (Gmail, YouTube, Android)

Go to myaccount.google.com and sign in.
Open Security & sign-in.
Under How you sign in to Google, choose Turn on 2-Step Verification and follow the steps.
Google will suggest Google prompts on your phone. You can also add a code app, a passkey or a security key.
Get your backup codes: a set of 8-digit codes you can print or download. Each one works once if you lose your phone. Keep them somewhere safe and never share them.

Apple Account (iPhone, iPad, Mac, iCloud)

On an iPhone or iPad go to Settings > [your name] > Sign-In & Security. On a Mac use System Settings.
Turn on Two-Factor Authentication and follow the steps. Most Apple Accounts already have it on.
When you sign in on a new device, a six-digit code appears on your other Apple devices (your trusted devices) or is sent to your trusted phone number.
Check that your trusted phone number is correct, and consider adding a second number, such as a partner's phone.

Microsoft account (Outlook, Hotmail, Xbox, Windows)

Go to account.microsoft.com/security and sign in.
Select Manage how I sign in.
Under Additional security, find Two-step verification and choose Turn on.
Follow the steps. If you choose the Microsoft Authenticator app you will scan a QR code (a square barcode) with your phone.
Microsoft recommends having three pieces of security information on the account, such as a phone number, another email address and the app. Without them, getting back in can take 30 days, and you may lose the account.

Some older mail apps and devices cannot ask for a code. After turning 2FA on, they may say your password is wrong. Microsoft solves this with an app password, found under Additional security options.

Banking, social media and shopping

Look in each app's Settings under Security or Password and security. Many banks have 2FA switched on already through their app or a card reader. Do your password manager too, because it holds every other password. See the Password Managers Explained for Everyone Guide.

Scams that target your codes

Criminals know 2FA works, so they try to trick you into handing over the second step. Learn to recognise these.

"Read me the code" calls and texts: someone claims to be your bank, a delivery firm, or a friend who "sent a code to your phone by mistake". The FTC's rule is simple: do not share a verification code with anyone if you did not contact them first.
Fake login pages: an email or text links to a page that looks like your bank or email. You type your password and code, and the criminal uses them straight away. Type the website address yourself instead. See the How to Spot a Phishing Email Guide.
Surprise prompts: your phone asks "Is this you signing in?" when you did nothing. Tap No. It means someone has your password, so change it.
SIM swaps: your phone suddenly loses all signal and says "No service" or "SOS only". A criminal may have moved your number to their own SIM card to receive your text codes. Contact your mobile provider at once from another phone. See the SIM Swap Fraud Guide.

Signs something is wrong

You receive a code or sign-in prompt that you did not ask for.
You get an email saying 2FA was switched off, your phone number was changed, or a new device signed in.
You cannot log in even though you are sure your password is right.
Friends receive odd messages from your account.
Your mobile phone loses signal for no reason while others nearby have signal.

What to do if it happens

These steps follow the NCSC's advice on recovering a hacked account.

Change your password on the affected account and on any account that used the same one.
Use the provider's official recovery page if you are locked out. Find it yourself, not through a link in a message.
Sign out all other devices from the account's security page, then check 2FA is still on and the phone number and email are yours.
Check your email for forwarding rules or filters you did not create.
Check bank and shopping accounts for payments you did not make. Contact your bank using the number on your card.
Warn your contacts to ignore recent messages from you.
Report it if you lost money (see Where to get help).

If you lose your phone: sign in on a trusted device you still have, use a backup code, or use your second phone number. Then remove the lost phone from the account and set 2FA up on your new phone. If you have none of these, use the provider's account recovery process, which can take days or weeks.

Where to get help

UK: the NCSC 2-step verification advice links to setup guides for major email and social media services. For a hacked account see NCSC: Recovering a hacked account. If you lost money, tell your bank and report it to Action Fraud, the UK's national fraud and cyber crime reporting centre (the NCSC now refers to the service as Report Fraud). In Scotland, call Police Scotland on 101.
US: read the FTC 2FA advice. Report identity theft and get a recovery plan at IdentityTheft.gov. Report online fraud to the FBI's Internet Crime Complaint Center (IC3).
Account help: Google, Apple and Microsoft keep their setup steps up to date.

Common failure patterns

Leaving it switched off. When the DNA testing company 23andMe was attacked in 2023, 2FA was optional and fewer than 22 percent of customers had turned it on. Attackers used reused passwords to open more than 18,000 accounts. See the 23andMe Breach 2023 page.
Protecting the bank but not the email. Whoever controls your email can reset your other passwords. Do email first.
No backup plan. People lose or replace phones without saving backup codes or adding a second number, then get locked out.
Reading a code to a caller. This is the most common way 2FA is defeated. Hang up and call the company on a number you trust.
Tapping Yes to every prompt. Only approve a sign-in you have just started yourself.
Remembering a public computer. Only tick "remember this device" on your own phone or computer, never a shared or library one.

Practitioner checklist

Your step-by-step checklist. Tick each one off.

Turn on 2FA for your main email account.
Turn it on for your bank, payment apps (such as PayPal) and online shops that save your card.
Turn it on for social media and your password manager.
Choose an app, phone prompt or passkey over text messages where you can.
Save backup codes on paper somewhere safe at home, or add a second phone number.
Check the phone number and recovery email on each account are up to date.
Only tick "remember this device" on your own devices.
Never read out or forward a code to anyone who contacts you.
Tap No to any sign-in prompt you did not start, then change that password.
When you change phones, move your authenticator app before wiping the old one.

Two-Factor Authentication for Everyone Guide: Plain-English Steps to Stay Safe