How do you turn on two-factor authentication and keep a backup way in?

Someone who gets your password could read your email, reset other accounts or pretend to be you. Two-factor authentication gives your account an extra check, so a password alone is often not enough to sign in.

You can set it up in a few minutes on Google and many other services. Before you start, have your phone ready and make sure you can access your account. The menu names can differ between apps, but the idea is the same.

What two-factor authentication does

Two-factor authentication, often called 2FA or two-step verification, asks for another form of proof when you sign in with a password. Depending on the service, that could be a prompt on your phone, a code from an authenticator app, a text message or a physical security key.

For example, if someone learns your password and tries to sign in from another device, the service may also ask for a code. Without that second step, the person may be stopped. It is not a guarantee against every scam, though. Someone who tricks you into giving them a code or approving their prompt can still gain access.

Start with your main email account. It is often used to reset passwords for shopping, social media and other accounts. If your password is weak or reused, create a stronger one as well.

Turn on two-step verification for your Google account

On an Android phone, you can open your Google account settings from Gmail or your phone’s settings. Make sure you are working with the correct account, particularly if you have more than one Gmail address.

1. Open the Gmail app and tap your profile picture in the top corner.
2. Tap Manage your Google Account. If necessary, switch to the account you want to protect first.
3. Open the Security & sign-in tab. You may need to swipe along the tabs to find it.
4. Find 2-Step Verification and tap it. Google may ask you to sign in again.
5. Follow the on-screen instructions to turn it on and set up an available verification method.

You can also open Google’s two-step verification settings in a browser after signing in. If the account belongs to a workplace or school, the administrator may control which methods are available.

Google may offer a prompt on a signed-in phone, an authenticator app, backup codes or other options. The options and screen labels can change, so follow the instructions shown for your account. Google’s official guide explains the available methods.

Choose a method you can use reliably

A phone prompt can be convenient. When you try to sign in, a notification appears on a signed-in device and asks you to confirm. Read the details and approve only a sign-in you started. If a prompt arrives when you are not signing in, reject it and check your account activity.

An authenticator app produces time-limited codes. During setup, the website normally displays a QR code or setup key that you add to the app. Enter the code shown by the app to finish linking it. Keep the QR code and setup key private, since someone who copies them may be able to generate codes too.

Text messages are familiar and may be the only option offered by some services. They still add a check, but a phone number can be affected by SIM-related attacks. Where available, consider a security key, authenticator or trusted-device prompt rather than relying only on SMS.

Passkeys are another sign-in option, but they are not simply an extra code after your password. They use your device and its screen lock or biometrics to verify you. Google says a passkey can replace the separate second step when you use it to sign in. Availability depends on the service and device.

Save a backup before you need it

If you lose your phone or change your number, a second step can become a problem unless you have another way in. After turning on 2FA, look for backup codes, a security key or another recovery method supported by the service.

Save backup codes somewhere private and accessible without the phone you are protecting. A secure password manager or a safely stored paper copy can work. Do not post them online or leave them in a shared folder. Some services issue one-use codes, so check the instructions and replace used codes when needed.

Also check that your recovery email and phone number belong to you and are current. If you use an authenticator, understand its transfer or backup process before replacing or wiping your phone. Do not assume every authenticator automatically copies your accounts to a new device.

Protect your other important accounts

After email, check your banking, social media, cloud storage and shopping accounts. Open each official app or website, then look under Settings, Security, Privacy or Login for two-factor authentication.

The exact steps are not the same everywhere. Some banking apps use device registration or transaction approval instead of a separate setting labelled 2FA. If you cannot find the option, use the bank’s official support channel rather than a number sent in an unsolicited message.

For social media, confirm that the recovery phone and email are yours before changing security settings. A person who controls your recovery details may be able to interfere with account recovery.

Never give a verification code to a caller

A message may claim to be from your bank, an online shop or a friend and ask for a code you just received. Do not share it. A code sent for your sign-in is meant for you to enter on the genuine service, not for someone else to collect over a call or chat.

If a caller says your account is in danger, end the call and contact the company using the number in its official app or on your card. Avoid opening a link supplied in an unexpected message. A real-looking login page can be fake.

An unexpected code does not always mean someone has entered your account. It can mean someone typed the wrong number or tried to sign in. Still, review your security activity and change your password if you notice a sign-in you do not recognise.

What if you lose the phone used for verification?

Try an unused backup code or another method you set up earlier. On Google, follow the available options on the sign-in screen or use Google Account recovery. For another provider, use its official recovery process. You may be asked for information to establish that the account is yours, and recovery is not always immediate.

Once you regain access, remove the lost device or old verification method where appropriate, update your recovery details and add a new backup method. If your SIM is missing, contact your mobile network promptly.

Two-factor authentication is most useful when you can still get into your own account. Set it up on your main email first, store a backup safely, then move on to the accounts that matter most to you.