G2GGet to grips with tech

Home / Stay Safe

How do I turn on two-step verification?

Two-step verification asks for a second check, like a code sent to your phone, when someone signs in. It keeps criminals out even if they know your password. Switch it on for your email first, then your bank, shopping and social media accounts. It takes a few minutes for each.

By Cameron, cybersecurity management graduateBeginner4 min readUpdated

What it is

It's also called 2SV, two-factor authentication (2FA) or multi-factor authentication (MFA). They all mean the same thing: as well as your password, you prove it's you a second way.

That second step might be a code sent by text or email, your fingerprint or face, or an approval tap in an app. Some services let you use a landline or a card reader instead of a mobile phone.

You won't need the code every time. Usually it's only asked for when something looks unusual, such as a sign-in from a new device or a request to change your password.

Why bother if your password is strong? Because passwords get stolen through no fault of your own, for example when a company you use is hacked. The UK's National Cyber Security Centre (NCSC) calls 2SV one of the most effective ways to protect your accounts.

Which accounts first

  1. Your email. Whoever controls your email can reset your other passwords.
  2. Your bank and payment accounts, like PayPal.
  3. Shopping accounts, like Amazon.
  4. Social media, like Facebook, Instagram and WhatsApp.

Google or Gmail

  1. Open your Google Account (myaccount.google.com, or Settings, then Google, on an Android phone).
  2. Tap Security & sign-in.
  3. Under “How you sign in to Google”, select Turn on 2-Step Verification.
  4. Follow the on-screen steps.

If it's a work or school account and these steps don't work, ask whoever runs that account.

Apple Account (iPhone, iPad, Mac)

Most Apple Accounts already have it switched on. To check:

  1. Open Settings on your iPhone or iPad (System Settings on a Mac).
  2. Tap your name, then Sign-In & Security.
  3. If it's off, turn on two-factor authentication and follow the on-screen instructions.

Any other account

Look in the account's Security settings for “2-step verification”, “two-factor authentication” or “2FA”. The NCSC keeps a list of links to the right page for popular services, including Outlook, Yahoo, Facebook, Instagram, Amazon, WhatsApp and PayPal.

Never share a code. A real company will never phone or text to ask you to read out a sign-in code. Anyone who does is trying to get into your account. Hang up.

Next: make a strong password you can remember, or learn how to spot a scam text.

Sources