BeginnerPasswords & Accounts

Turn on two-factor authentication on every important account

Two-factor authentication (2FA) means that even if a criminal knows your password, they still can't get into your account without your phone.

When 2FA is turned on, logging in requires two things: your password AND a code sent to your phone (or generated by an app). Without both, the door stays locked.

Start with the accounts that matter most: your email, online banking, Amazon, Apple ID or Google account, and any social media accounts linked to your business. Each one has a security or account settings menu with a two-factor authentication option.

The best option is an authenticator app like Google Authenticator or Microsoft Authenticator — these are free to download and generate codes that work even without a phone signal. SMS codes (text messages) are the second-best option and still far better than no 2FA at all.

Setting up 2FA on a typical account takes about three minutes. Do it today for your email account — that one matters most because email is used to reset passwords on everything else.

Tags

2FAtwo-factor authenticationaccount securityauthenticator app

More in Passwords & Accounts

All guides
beginnerfeatured

Use a password manager so every account has a different password

Using the same password on multiple accounts is one of the most dangerous security habits — and one of the most common. When any website is hacked and your email and password are stolen, criminals test those same credentials on Gmail, Facebook, Amazon, banking apps, and dozens of other services automatically. If you reuse passwords, one breach becomes many. A password manager solves this by remembering a unique, random, strong password for every single account. You only need to remember one master password — everything else is handled for you. Bitwarden is completely free for personal use, open-source, and works across iPhone, Android, Chrome, Firefox, and Safari. 1Password and Dashlane are paid options with more features. Most iPhones and Chrome browsers now have basic built-in password managers, which are better than nothing. Once set up, switching to a password manager takes about an hour of updating existing accounts — time well spent considering what's at risk. Start with your most important accounts: email, banking, and Amazon.

See: The Fake Amazon Seller Account TakeoverPasswords & Accounts
beginner

Set up recovery options on your Google and Apple accounts now

Your Google account (if you use Android or Gmail) and your Apple ID (if you use an iPhone) are the keys to almost everything you do online. If you lose access to them, recovering is a nightmare. If criminals get into them, they can reset every other password you have. The single best thing you can do today is add a recovery phone number and backup email address to both accounts. This takes five minutes and means that if you get locked out — or if someone tries to take over your account — you have a way back in. For Google: Go to myaccount.google.com → Security → Ways we can verify it's you. For Apple: Go to Settings → [Your Name] → Password & Security → Recovery Contact. While you're there, check the "Devices" or "Where you're signed in" section of both accounts and remove any devices you don't recognise. This is how you check whether anyone else is already logged into your account.

See: The Café Owner Who Lost Access to EverythingPasswords & Accounts