Somebody got into an email account in March and did nothing with it for eleven weeks. Then, on a Tuesday, they used it to reset the password on a bank login, intercepted the confirmation, and moved money. The password that was stolen had been reused on a forum that was breached in 2019. Nothing about this required skill. It required one password and the absence of a second step, and the second step takes about ninety seconds to add.
The order, and why it is this order
- Your primary email. Everything recovers through it.
- Your phone carrier account. This is the one nobody thinks of, and it is how SIM swaps happen. If someone can log into your carrier account, they can move your number to their phone and start receiving your codes.
- Your bank and anything holding money — including PayPal, Venmo, Cash App and your brokerage.
- Your password manager, if you use one. It holds everything else.
Everything beyond those four is optional. Four accounts, maybe eight minutes total.
The methods, from worst to best
They are not equivalent, and the most common one is the weakest.
SMS codes — a text message with six digits. Far better than nothing, and vulnerable to the SIM swap: someone convinces your carrier to move your number to their SIM, and every code follows them. Use it only where nothing better is offered, which is still a lot of banks.
Authenticator app — a code that rotates every thirty seconds. Google Authenticator, Microsoft Authenticator, Authy, or the one built into your password manager. The code is generated on the device itself, so there is no message to intercept and the SIM swap stops working. This is the right default.
Push approval — a notification saying “is this you?” Convenient and genuinely strong, with one weakness: people tap approve reflexively. If a prompt appears when you were not logging in, that is someone with your password. Deny it and change the password immediately.
Passkeys — your fingerprint or face, no code at all. The newest and the strongest. A passkey cannot be phished, because it is cryptographically bound to the real website; a fake login page simply cannot use it. Where it is offered, take it.
Hardware key — a physical thing you plug in or tap. The strongest available, around 30 dollars. Worth it if you have something genuinely valuable to protect.
Setting it up, generically
Every service hides this in the same place with slightly different words. Look for Settings → Security, then Two-factor authentication, 2-Step Verification, or Login verification.
- Choose authenticator app if offered.
- A QR code appears. Open your authenticator app, tap +, scan it.
- The app shows a six-digit code. Type it in to confirm.
- Save the backup codes. This is the step everyone skips and it is the one that matters.
Backup codes: the part that goes wrong
When you enable two-factor, the service offers eight or ten single-use codes. These are how you get back in when the phone is lost, broken or stolen — which is the exact scenario you were protecting against.
People screenshot them to the phone. The phone is the thing that gets lost. Then the account is permanently inaccessible, and support cannot help, because an account they can unlock for you is an account they can unlock for someone pretending to be you.
Put them somewhere that is not the phone:
- Printed and in a drawer or a document bag
- In a password manager that syncs across devices
- Written on a card at a relative’s house
The carrier account, specifically
This is the one almost nobody protects, and it undermines everything else.
Log into your carrier and look for a port-out PIN, number transfer PIN or account PIN, and set one that is not your birthday or the last four of your Social Security number. Then enable two-factor on the carrier account itself.
With a port-out PIN set, someone who walks into a store with your name and address still cannot move your number. Without one, the whole chain above is only as strong as a phone rep’s judgment on a busy afternoon.
If you lose the phone with the authenticator on it
- Use a backup code to get into the account.
- Turn off two-factor, then turn it back on with the new device. This generates a new secret and invalidates the old one.
- Generate fresh backup codes. The old set is gone with the phone.
To avoid the whole situation, pick an authenticator that syncs — Authy, Microsoft Authenticator, 1Password and Bitwarden all back up to your account. Google Authenticator now syncs too, provided you switched it on. Plain offline authenticators are marginally more secure and considerably more likely to lock you out permanently.
What this does not protect you from
Worth being honest about. Two-factor stops someone who has your password. It does not stop you from typing a code into a convincing fake page — that is phishing, and the code works for the attacker in real time. The defence there is the same as always: go to the site yourself rather than through a link, and never read a code out loud to someone who called you.
Passkeys are the exception, and the reason they matter: there is no code to give away.
