Two-Step Verification: Which Kind to Use and Why

The attacker who broke into Uber’s systems in September 2022 already had a contractor’s work password, most likely bought online, and kept trying to sign in with it. Each attempt sent the contractor a request to approve the login, and at first those requests kept the attacker out. Then the contractor accepted one, and the attacker was in.¹

That story holds the whole case for two-step verification, and its one weak spot. Two-step verification (2SV; you will also see two-factor authentication, 2FA, and multi-factor authentication, MFA) adds a second proof after your password, so someone holding only the password still can’t get in. Not every second step is equally hard to get around. The US Cybersecurity and Infrastructure Security Agency (CISA) ranks the options from strongest to weakest, with phishing-resistant methods such as security keys at the top and codes sent by text message at the bottom, and it notes that any form is better than none.² Setting it up well comes down to four steps:

1. Turn it on for your email first
2. Choose the strongest method the account offers
3. Save your backup codes where you can find them
4. Refuse any sign-in request you didn’t start

Why a second step stops most stolen-password attacks

Two-step verification works because the second proof is something a person holding your stolen password usually does not have: your phone, a key on your keyring or your device’s screen lock. The UK’s National Cyber Security Centre (NCSC) counts switching it on among the most effective protections an online account can have. Passwords leak through no fault of yours: the NCSC names breaches at organizations that store your details as the most common source of stolen passwords, which criminals then try on other sites, and it points out that making a password harder to guess does nothing to stop it being stolen.³

Unique passwords limit the damage from one breach, and how to choose between password managers makes them practical. Two-step verification covers the rest, which is why it ranks among the handful of habits that make up everyday digital safety.

Picture a food-delivery site you used once. It is breached, and your email address and password end up on a list that someone feeds into a login script aimed at your inbox. Without a second step, the script signs straight in. With one, it meets a request for a code or an approval on a phone it does not hold, and gets no further.

One large measurement of how much this matters comes from Microsoft’s own sign-in data.

The study

Moderate evidence

Microsoft (2023): multi-factor authentication on work accounts

Microsoft researchers estimated how many work and school accounts on the company’s sign-in service were taken over during five months of 2022. Without multi-factor authentication, about 1 in 100 accounts were compromised; with it, fewer than 1 in 10,000 were, a drop the authors put at 99%.⁴

The second step turned a common outcome into a rare one. Keep the limits in view: the paper is a preprintpreprint: A research paper posted publicly before it has been peer reviewed or published in a journal; in economics and finance the same stage is usually called a working paper. Its findings may change, or fail to hold up, by the time it is published.Full entry in the glossary by Microsoft staff about Microsoft’s own service, it covers work accounts rather than personal ones, and we found no independent replication. Google’s 2019 study of its consumer sign-ins, a different company’s data, pointed the same way.⁵

The biggest gain comes from having any second step at all. Choosing the best kind comes next, and it matters mostly against one threat, the fake login page.

Five kinds of second step, from strongest to weakest

From strongest to weakest, the five common kinds of second step are passkeys and security keys, app prompts, authenticator-app codes, text-message codes and email codes. The order follows CISA’s 2022 ranking with one adjustment: CISA puts codes level with app prompts that make you match a number, and plain tap-to-approve prompts below both. Either way, the ranking turns on one question: can a fake website trick you into handing the second step over?²

A code is only a number, so a fake login page can ask for it and pass it on. CISA describes exactly this: a phishing email leads to a copy of a company’s login page, and the victim types in a username, a password and the six-digit code from an authenticator app.² Passkeys and security keys work differently. They refuse to sign in to an impostor site without relying on you to spot the fake, which is how the US government’s 2025 NIST guidelines define phishing resistance.⁶ The NCSC’s April 2026 comparison found passkeys and security keys at least as secure as a password with any traditional second step, at every stage and against every commonly seen attack, and not open to the prompt-flooding attacks that app approvals can suffer.⁷

Google’s help pages add the ease side of the ranking, and they are why prompts sit above codes here. If you don’t use a passkey, Google recommends its sign-in prompts, saying a prompt is easier to tap than a code is to type and helps protect against SIM swaps. It notes that authenticator apps work without an internet connection or mobile service, and that texted codes can be vulnerable to attacks on your phone number.⁸ The Microsoft study found the same direction in practice: among work accounts whose passwords had leaked, texted codes failed more often than its authenticator app.⁴

Myth

Text-message codes are so weak they aren't worth turning on.

Fact

CISA ranks them last among second steps yet says any form of multi-factor authentication is better than none. Use texts until something stronger is offered.

So don’t wait for the perfect option. If an account offers only text codes, turn them on today and switch when it adds something stronger. The fine print on authenticator apps versus texts, and how passkeys behave day to day, deserves its own guide.

Turning on two-step verification, account by account

Setting up two-step verification takes a few minutes per account. The NCSC says the switch is usually found in an account’s security settings, sometimes under another name such as two-factor authentication.³ Have your phone and a pen nearby, and start with the account that matters most.

1. Turn it on for your email first

Your email comes first because the password-reset links for most of your other accounts go there, so whoever controls it can take over the rest. The paths below are the ones each provider gives today; menus change, so search the provider’s help pages if yours looks different.

• For Gmail and other Google accounts, open your Google Account, go to Security & sign-in and, under “How you sign in to Google,” select Turn on 2-Step Verification.⁸
• For Outlook and other Microsoft accounts, go to the Security tab at account.microsoft.com/security, choose Manage how I sign in, then turn on two-step verification. Microsoft says it is starting to phase out texted codes for personal accounts.⁹
• For iCloud and other Apple accounts, Apple says most accounts already use two-factor authentication; if yours does not, turn it on in Settings on an iPhone or iPad, or System Settings on a Mac.¹⁰

Once email is done, give banking, social media and online shopping the same treatment.

2. Choose the strongest method the account offers

Pick from the top of the ranking down: a passkey or security key if the account supports one, then app prompts, then an authenticator app, with text codes as the fallback. Then add a second method, so that losing one phone does not shut you out. Microsoft warns that if you lose your only contact method, getting back into an account can take 30 days, or fail, and recommends three pieces of security information.⁹

Be careful with the “Don’t ask again on this device” box. Google advises ticking it only on devices you use regularly and don’t share with anyone.⁸ Your own laptop, yes; a shared family tablet or a library computer, no.

3. Save your backup codes where you can find them

Backup codes are single-use codes that stand in for your second step when your phone is lost, replaced or out of signal. Google, for example, gives a set of 10, and each works once; creating a new set cancels the old one. It suggests printing them and keeping them somewhere safe, such as where you keep your passport, and says it never asks for a backup code except at sign-in.¹¹

Keep the codes away from the phone they back up: a set saved only on that phone disappears with it. If a stranger, a caller or a website asks for one, the request itself is the warning sign. The wider question of how to plan for losing access belongs to a guide of its own.

4. Refuse any sign-in request you didn’t start

A sign-in request you didn’t trigger means someone is trying to get into your account, usually with your correct password. CISA calls the tactic “MFA fatigue” or “push bombing”: an attacker who has your password can send hundreds of approval requests to your phone in a short time, hoping you tap Approve by accident, out of annoyance, or because you assume one of them is real. That is what happened to the Uber contractor.¹ Services can defend against it with number matching, where you must type a number shown on the login screen into your phone before it approves anything, so an attacker who cannot see your screen cannot get your approval. CISA recommends it wherever phishing-resistant methods are not yet possible.¹²

1. 1Password enteredon the real login page
2. 2Page shows a numberunique to this sign-in
3. 3Phone asks for ityou type the number in
4. 4No number, no approvala flood of prompts gets nowhere

That small extra step is why a stranger’s flood of prompts goes nowhere: each prompt needs a fresh number that only appears on the attacker’s own screen, and you never see it. The 2025 NIST guidelines go further and no longer accept prompts that only ask you to compare a code and tap approve, citing these “authentication fatigue” attacks; the code has to be carried across, for example by typing it in.⁶

The rest is up to you. ENISA, the EU agency for cybersecurity, puts the rule in two parts: give your verification codes to nobody, and approve only sign-ins you began yourself.¹³ Watch for a prompt that arrives when you aren’t signing in, several in a row, or a message or call from “support” asking you to approve one.

An unexpected prompt is not a glitch to dismiss. Tap No or Deny, treat it as a sign someone knows your password, and change that account’s password and the password of any other account that shares it.

Two-step verification in one sitting

• Protect my main email account with a second step
• Add a passkey or security key where my accounts offer one
• Otherwise choose app prompts or an authenticator app over text codes
• Add a second method so one lost phone cannot shut me out
• Print or safely store my backup codes, away from my phone
• Repeat for banking, social media and shopping accounts
• Deny any sign-in prompt I did not start, then change that password

Download PDF ↓

Get this checklist as a one-page PDF. We'll email you the download link.

Your emailAlso send me the weekly newsletter (launching soon)Email me the PDF

We use your address to send this link and, only if you tick the box, the newsletter. Privacy policy.

When your bank chooses the method for you

Banks often decide which second step you may use, and the rules differ by country. In July 2024, the Monetary Authority of Singapore and the Association of Banks in Singapore announced that major retail banks would phase out one-time passwords for logins by customers who had activated a digital token in their banking app. Their reason matches the ranking above: the announcement says scammers had found it easier to phish one-time passwords, for example through fake bank websites that closely resemble the real ones, while the app-based token confirms a login without a code anyone can steal.¹⁴

The United Arab Emirates is moving the same way: Gulf News reported in 2025 that the UAE central bank’s guidelines require banks to switch to app-based authentication, with texted codes due to end by March 2026; we could not check the central bank’s own notice.¹⁵

In practice, that means your bank may insist on its own app even if you would rather use a security key, while a bank elsewhere may still send only text codes. Use what your bank offers, keep its app updated, and check your bank’s website or your national banking regulator for the rules where you live.

Treat a banking app’s approval request like any other prompt: approve only a login or payment you started yourself.

The bottom line

Any second step makes a stolen password far less useful, so the first move is simply to turn it on, starting with your email. Where you have a choice, pick a passkey or security key, then an app prompt, and keep text and email codes as fallbacks. Store your backup codes away from your phone, and never approve a sign-in you did not start, however many times your phone asks.