Two-Factor Auth (2FA)
Single best protection against hacking.
What is 2FA?
- Password + second verification = login.
- Code sent to phone, OR app code, OR fingerprint.
- Stops 99% of hacking attempts.
- Required by most banks now.
- Free.
- Works on email, banking, social media.
Methods, best to worst
- Authenticator app (Google, Microsoft, Authy) — BEST.
- Passkey / Face ID — easiest, also best.
- Hardware key (YubiKey) — most secure.
- Email backup code — okay.
- Text message code — okay but SIM swap risk.
- Avoid text-only if possible.
Critical accounts to protect
- Email — protect FIRST. Gateway to everything.
- Banking + investment.
- Apple ID / Google account.
- Tax sites (IRS, state).
- Medicare.gov + Social Security.
- Amazon.
- Facebook — identity theft vector.
Setup steps
- Sign into account.
- Settings → Security → Two-Factor or 2-Step Verification.
- Choose method (recommended: app + backup phone).
- Scan QR code with authenticator app.
- Save backup codes printed somewhere SAFE.
- Test by logging out + back in.
- 10 min per account.
Best authenticator apps
- Google Authenticator — simplest. FREE.
- Microsoft Authenticator — Microsoft accounts.
- Authy — backs up codes (helpful if lose phone).
- 1Password / Bitwarden — built into password manager.
- All free.
If you lose phone
- Backup codes save you (printed somewhere safe).
- Authy syncs to new phone (Google Auth doesn't).
- Trust contact (Apple, Google) recovery.
- Don't skip backup codes — critical.
- Print + put in safe / safety deposit.
Family member helps
2FA setup intimidating but worthwhile. Have tech-savvy family member set up critical accounts. Email + bank + Apple ID = top 3. After done — stays set up. Phone-text 2FA ok for non-critical (Facebook, etc.). App-based for critical.