Two-step sign-in and passkeys: a second lock on your accounts

Turn on two-step sign-in for your email and money accounts, print the backup codes, make a passkey where offered, and lock your phone number with your carrier.

1. What two-step sign-in is Understand

A password is one thing you know. Anyone who learns it can type it in from anywhere in the world. Two-step sign-in adds a second check after the password: something only you should have, such as a code sent to your phone, a tap on a message from the account, or the unlock on your own device. A person who has only your password stops at that second check.

Your starting list named your main email as the first key to everything else, because whoever controls it can reset your other passwords. Passwords gave it a new password. This chapter puts the second lock on it, then on your money accounts, and then on the second key: your phone number. The UK's National Cyber Security Centre (NCSC) counts two-step sign-in among the most effective ways to protect an online account (NCSC, Turn on 2-step verification), and its password guidance puts it first, before giving each account a different password (NCSC, Managing your passwords). The order in this manual, email first, then money, then the phone number, is ours. Our convention

One idea, several names

Companies use different names for the same thing. The US Cybersecurity and Infrastructure Security Agency (CISA) lists them: multifactor authentication (MFA), two-factor authentication (2FA), two-step authentication and 2-Step Verification (CISA, More than a Password; the page carries CISA's archived banner, and its advice matches CISA's current campaign). Google says 2-Step Verification, Apple says two-factor authentication, Microsoft says two-step verification, and AOL says 2-Step Verification. This manual says two-step sign-in for all of them. In the steps we use each company's own words, because those are the words on the screen.

What happens when you sign in

Two-step sign-in asks for the second check when you sign in on a new device, in a new browser or on the web. Apple describes it this way: you type your password, then a six-digit code that appears on one of your trusted devices or arrives at a trusted phone number (Apple Support, Two-factor authentication for Apple Account). A trusted device is a phone, tablet or computer that is already signed in to the account, which the account uses to confirm it is you. Product-specific

On a phone or computer you have already signed in on, most accounts do not ask every time. Google lets you tick "Don't ask again on this device," and asks you to tick it only on devices you use regularly and do not share (Google Account Help, Turn on 2-Step Verification). That is why turning it on rarely changes your day. The second check appears when something new happens, which is when it matters.

What it stops, and what it does not

CISA's position is short: "any MFA is better than no MFA." The Electronic Frontier Foundation (EFF), a digital rights nonprofit, says the same of the weakest kind, a code by text message: it "is better than nothing" (EFF Surveillance Self-Defense, How to: Enable Two-factor Authentication). The Federal Trade Commission (FTC) uses the same words for text codes when they are the only option (FTC, Use Two-Factor Authentication To Protect Your Accounts, September 2022).

What it does not stop is a person being talked into handing over the second check. EFF points out that a fake sign-in page can ask for your code as well as your password, and a text or app code typed into that page works for the thief. A caller can ask you to read a code aloud. A thief who has your password can send sign-in prompts to your phone and hope you tap Yes. The two rules later in this section answer those three tricks. Recognizing scams covers the people who try them.

No source we read gives a reliable figure for how many attacks two-step sign-in stops, so this manual gives none. It says what the step does: a stolen password alone no longer gets in.

2. The methods, strongest to weakest

Most accounts offer more than one kind of second check. CISA ranks them in a fact sheet written for IT managers (CISA, Implementing Phishing-Resistant MFA, PDF, October 2022). The FTC and Google give consumers the same order. The table puts the ranking in plain terms.

Four terms from the table. An authenticator app is a free app that shows a new short code every 30 seconds or so for each account you link to it; Google Authenticator, Microsoft Authenticator and Duo are the examples the FTC names, and EFF notes that these apps are free. A prompt is a message the account sends to your phone asking whether you are signing in, with Yes and No buttons. Number matching adds one more check to a prompt: the sign-in screen shows a number and you type that number into the app on your phone, so a prompt you did not start is much harder to approve by accident (CISA, Implementing Number Matching in MFA Applications, PDF). A method is phishing-resistant when a fake website cannot collect it and use it; CISA says the only widely available phishing-resistant method is the FIDO standard behind passkeys and security keys. Product-specific

Which one to pick

Pick the strongest method your account offers that works on a device you own. For most people on a first pass that is the phone prompt or an app. A passkey is stronger still, and section 4 covers it once two-step is on. Our convention

For a Google Account, Google itself recommends Google prompts as the second step if you do not sign in with a passkey, and says prompts "can also help protect against SIM swap." Google sends prompts to Android phones signed in to the account, and to iPhones with the Gmail app, the Google Photos app, the YouTube app or the Google app signed in. You tap Yes if you started the sign-in and No if you did not. Product-specific

If an account offers only text codes, use text codes. That is the right first step, not a failure, and every source above agrees it beats no second check.

Why text codes are the weakest, and still worth having

A text code rides on your phone number, and a phone number can be moved. In a SIM swap, a thief persuades your phone company to move your number to a SIM card in the thief's phone. Your texts and calls, including sign-in codes, then go to the thief. The National Institute of Standards and Technology (NIST), which writes the federal rules for how services handle sign-in, names this threat and calls text and voice codes "restricted": services that send them must offer another option (NIST SP 800-63B-4, Digital Identity Guidelines, July 2025). NIST's rules bind services, not people. They explain why the services you use are moving away from text codes.

Google says text and call codes "can be vulnerable to phone number-based hacks." Microsoft says it will start phasing out text codes for personal accounts and calls them "a leading source of fraud" (Microsoft Support, Microsoft to stop sending SMS codes for personal accounts; no end date is given). CISA's fact sheet says text and voice codes should be a last resort, though acceptable as a temporary step. Product-specific

So the default is: start with a text code when that is all the account offers, move up to a prompt, an app or a passkey when it offers one, and lock your number with your phone company either way (section 5). Turning the text option off afterward is Go deeper, and it comes with a condition in the Limits box below.

The two rules

Two habits close the gap that settings leave open. Both come straight from the companies and agencies cited here; the short wording is ours. Our convention

Approve only a sign-in you started. A thief who has your password can send prompt after prompt to your phone, hoping you tap Yes. CISA calls this MFA fatigue, or push bombing: repeated prompts until a person approves one "by accident or out of annoyance." Google's instruction is the rule itself: tap Yes if you requested the sign-in, No if you did not. A prompt or a code you did not ask for means someone may have your password. Tap No, then change that account's password from its own settings (Passwords shows how).

Do not read, forward or type a code for anyone who contacted you. Google says it does not ask for your password or codes by email, phone call or message, and asks for a backup code only at sign-in (Google Account Help, Sign in with backup codes). AOL says it does not ask for your password by email or phone. The FTC's advice is to share a code with no one you did not contact first, and its alert on bank imposters says no caller, including a fraud department, will ask for your verification code: "That's always a scam" (FTC consumer alert, July 8, 2024). A code arrives because someone is signing in. If that someone is not you, the code is the last thing between them and the account.

3. Turning it on, account by account

Each account has its own settings page. The table lists where two-step sign-in lives for the accounts this manual covers, and whether the account gives you something to print. Steps for each one follow it. The same paths are in the Where the settings are table.

Google Account (Gmail)

This works in any web browser: Safari on an iPhone or iPad, Chrome on an Android phone, Windows computer or Chromebook, or Safari on a Mac.

1. In your browser, go to myaccount.google.com and sign in.
2. Select Security & sign-in.
3. Under How you sign in to Google, select 2-Step Verification.
4. Select Turn on 2-Step Verification.
5. Follow the steps on the screen. Where Google offers Google prompts, choose them.

In short: Google Account > Security & sign-in > How you sign in to Google > 2-Step Verification. Older guides call the tab Security. Google notes that a phone number newly added for 2-Step Verification can take up to 7 days to be trusted, and that Google will not call you to check a code. Print the backup codes next (backup codes). Product-specific

Apple Account

Apple says two-factor authentication is the default for most Apple Accounts, and that Apple Pay and Sign in with Apple require it. So on an Apple Account the job is usually to check that it is on, and that the trusted phone number is the one you have now.

1. On your iPhone or iPad, open Settings.
2. Tap your name at the top.
3. Tap Sign-In & Security.
4. Read the line for two-factor authentication. If it says Off, tap Turn On Two-Factor Authentication and follow the steps.
5. Check that the trusted phone numbers listed are numbers you have now.

In short: Settings > [your name] > Sign-In & Security. On a Mac: Apple menu > System Settings > [your name] > Sign-In & Security. On the web: account.apple.com, sign in, then Upgrade Account Security. Apple says an account created with two-factor cannot turn it off, and a recent upgrade can be reversed only within two weeks. Apple's page describes no printed backup codes; its second step comes from your trusted devices and trusted numbers. Its printed option is the recovery key, which turns off Apple's standard account recovery and can lock you out for good if lost (Getting back in). Product-specific

Microsoft account (Outlook.com, Hotmail, Live)

This works in any web browser on any device.

1. In your browser, go to account.microsoft.com/security and sign in.
2. Select Manage how I sign in.
3. Under Additional security, find Two-step verification.
4. Select Turn on and follow the steps.

In short: account.microsoft.com/security > Manage how I sign in > Additional security > Two-step verification > Turn on. Microsoft says some older email apps need an app password once two-step is on. Because Microsoft is phasing out text codes, choose an authenticator app or a passkey if the screens offer one. Microsoft's printed item is a single recovery code, covered under backup codes. Product-specific

AOL

1. In your browser, go to login.aol.com/myaccount/security and sign in.
2. Next to 2-Step Verification, click Turn on.
3. Choose Phone number.
4. Follow the prompts.

In short: AOL Account Security page > 2-Step Verification > Turn on. AOL sends the code by text or call, and says the number it sends from may change. An authenticator app option appears only when the account has at least two recovery methods, and AOL says it is not yet offered on every account (AOL Help, Add or disable 2-step verification). If you see Authenticator app, it is the stronger choice. The AOL pages we read do not mention backup codes, so for AOL the way back in is a current recovery phone and email (Getting back in). Product-specific

Yahoo, your internet company and other providers

Yahoo's help pages we checked cover signing in, the Sign-in Helper and changing a password, and they name an Account security page with a section called Ways of signing in (Yahoo Help, Fix problems signing into your Yahoo account). They do not describe Yahoo's two-step setting, so we give no Yahoo path. Look on that Account security page, and use Yahoo's own help if the setting is not there. Ask Yahoo

For email from your internet company or another provider, CISA's archived guide gives the general hunt: open the account's settings (often called Account Settings, Profile, Preferences or Privacy), then its security settings, and look for two-factor or two-step authentication. If you cannot find it, call the company at the number on your bill. Ask your provider

Bank, card and money app accounts

CISA lists financial services second, after email, among the accounts to protect with two-step sign-in. The FTC's list starts with banks and credit cards, then email, social media, the site you file taxes on, and payment apps, and it notes that two-step sign-in is "not usually on by default." Each bank sets up its own. Many use text codes, and some offer their own app's prompt.

1. Open your bank's own app, or type its web address yourself. Do not use a link from a text or an email (Recognizing scams).
2. Sign in and open the settings, profile or security area.
3. Look for two-step, two-factor, sign-in security or verification.
4. Turn it on with the strongest method offered.
5. Write "two-step" and the method on the account list row for that bank or card.

If you cannot find it, call the number on the back of your card and ask what sign-in protection the bank offers. A bank's options are its own decision. Ask your bank

Backup codes

Backup codes are single-use codes the account gives you ahead of time, to type in when your phone is lost, broken or out of reach. They are the main reason two-step sign-in does not lock people out. NIST describes saved recovery codes as meant to be kept offline, "printed or written down," and stored securely. Google and Microsoft say to print them. Product-specific

Google. Google gives a set of 10 codes, each 8 digits, each usable once. Making a new set cancels the old one. Google suggests keeping them "where you keep your passport or other important documents," and you can print them. Backup codes show only once 2-Step Verification is on.

1. In your browser, go to myaccount.google.com and sign in.
2. Select Security & sign-in.
3. Under How you sign in to Google, select 2-Step Verification.
4. Select Backup codes.
5. Select Get backup codes, then Print codes.

In short: Google Account > Security & sign-in > 2-Step Verification > Backup codes > Get backup codes. When you use one, Google suggests marking it used, since each works once.

Microsoft. Microsoft gives one recovery code of 25 characters. It says to print it and keep it in a safe place, not on a device you use to sign in. Microsoft does not show a code again once it is made, and making a new one cancels the old one.

1. In your browser, go to account.live.com/proofs/manage/additional and sign in.
2. Find Recovery code.
3. Select Generate a new code.
4. Print the code, or write it on paper.

In short: account.live.com/proofs/manage/additional > Recovery code > Generate a new code.

Where the paper goes. Put the printout with your other printed codes, in the same place as your passport or other important papers. Then write that place, not the codes, in the "printed codes kept" column of the recovery sheet, and mark "backup codes printed: yes" on the account list. This manual's sheets are stored in the browser and printed; they hold no codes. Our convention

"Don't ask again on this device"

The tick box that skips the second check saves time on your own phone and computer. Google asks you to tick it only on devices you use regularly and do not share, and the FTC says to let an account remember only your own devices. Leave it unticked on a library computer, a friend's tablet or a work computer that others use. Product-specific

4. Passkeys

A passkey is a sign-in that your phone or computer makes for one account, and that you use by unlocking the device with your face, fingerprint or screen lock. Behind it is a pair of matching keys. The site keeps the public half. Your device keeps the private half and does not send it to the site. Apple describes this as "no shared secrets": there is nothing on the site's side for a thief to steal and nothing for you to type (Apple Support, About the security of passkeys; FIDO Alliance, Passkeys, the standards group behind them).

Because nothing is typed, a fake sign-in page has nothing to collect, and a passkey made for one site does not work on another. That is what makes it phishing-resistant. The NCSC recommends passkeys over passwords wherever they are offered, and calls them more secure than a password with the usual two-step sign-in. Google treats a passkey sign-in as both steps at once, because it proves you have the device. Product-specific

What a passkey does not settle

A passkey is as strong as the lock on the device that holds it. Google says to make passkeys only on devices you personally own and use, because anyone who can unlock the device can get into the account (Google Account Help, Sign in with a passkey). Google also says adding a passkey does not remove your other ways to sign in or recover the account. So the account still has its password, its recovery phone and email, and its two-step method. Each of those is still a way in, which is why Getting back in, Passwords and Your phone and tablet still matter. Product-specific

Making one

Make passkeys after two-step sign-in is on and the backup codes are printed. One passkey on your main email is a good first one; the rest can wait. Our convention

Google Account. Google lists the minimums: Windows 10, macOS Ventura, ChromeOS 109, Android 9 or iOS 16 or later, a recent browser, and a screen lock on the phone. On the phone or computer you want to use:

1. In your browser, go to myaccount.google.com/signinoptions/passkeys and sign in.
2. Select Create a passkey.
3. Unlock your phone or computer when it asks, with your face, fingerprint or screen lock.

In short: myaccount.google.com/signinoptions/passkeys > Create a passkey. To remove one later: Google Account > Security & sign-in > Passkeys and security keys, select it, then Remove.

Microsoft account.

1. In your browser, go to account.live.com/proofs/manage and sign in.
2. Select Add a new way to sign in or verify.
3. Choose Face, Fingerprint, PIN, or Security Key.
4. Follow the steps on your device.

In short: account.live.com/proofs/manage > Add a new way to sign in or verify. Microsoft suggests saving the passkey to a password manager that syncs across your devices. If you save it on one device only, it suggests making another on a second device as "a digital spare key" (Microsoft Support, Create and save a passkey). On a Windows computer, the passkeys saved on that computer are listed under Start > Settings > Accounts > Passkeys.

On an iPhone or iPad, for websites and apps. Apple's Passwords app stores passkeys, and needs iCloud Keychain and two-factor authentication on. When a website or app offers a passkey:

1. Sign in to the website or app as usual.
2. Open its account settings.
3. Look for an option to create or add a passkey.
4. Tap Continue when your iPhone offers to save it.

If no passkey option appears, the site does not offer passkeys yet (iPhone User Guide, Use passkeys to sign in). The passkey then appears in the Passwords app next to that account's password. On a Mac, Android phone or Chromebook, the Google steps above work in the browser, and websites that offer passkeys work the same way: sign in, open account settings, add a passkey. Product-specific

On the account list, change the two-step column to "passkey" for any account where you made one.

5. Your phone number: the number lock

Your phone number is the second key from Your starting list. It receives text codes and recovery messages, and a thief who moves it can receive them instead. There are two ways to move it. A SIM swap moves it to a new SIM card at the same company. A port-out moves it to a different phone company. A number lock is a setting at your phone company that blocks one or both until you turn it off. CISA advises an extra PIN or passcode on the mobile account that is required for changes such as porting, and EFF advises asking your carrier for a PIN or spoken password. Verizon, AT&T and T-Mobile each offer locks, and AT&T and T-Mobile say theirs are free. Product-specific

Verizon

1. Go to My Verizon and sign in as the Account Owner or an Account Manager.
2. Select Account, then Account settings.
3. Select Security settings.
4. Next to Number Lock, select Edit, choose your numbers and save.
5. Next to SIM Protection, select Edit, choose your numbers and save, if you want that lock too.

In short: My Verizon > Account > Account settings > Security settings > Number Lock and SIM Protection. Verizon says a locked number cannot generate a Number Transfer PIN, so to switch carriers you unlock it first. Turn SIM Protection off before you upgrade your phone and back on after; Verizon says SIM changes stay blocked for 15 minutes after you turn it off (Verizon Support, Enable or disable SIM Protection and Number Lock). Product-specific

AT&T

1. Open the AT&T app on a phone that is on the account.
2. Tap the person icon.
3. Tap Wireless account lock.
4. Swipe to lock.

In short: AT&T app > person icon > Wireless account lock. On prepaid: AT&T app > Profile & Settings > Account Info & Preferences > Wireless Account Lock > Turn on, confirmed with a texted code (AT&T Support, Learn about Wireless Account Lock). The same screen unlocks the account when you need to make a change. Product-specific

T-Mobile

1. Open the T-Life app.
2. Tap the Manage tab, then the gear icon.
3. Tap Security, then SIM Protection.
4. Turn it on for the account or for each line, tap Save Changes, then Continue.
5. For Port Out Protection, go back to the Manage tab, tap See Plans, then Manage add-ons.
6. Select the line, check Port Out Protection, tap Continue, then Agree & Submit. Repeat for each line.

In short: T-Life > Manage > gear > Security > SIM Protection, and T-Life > Manage > See Plans > Manage add-ons > Port Out Protection. T-Mobile also has an account PIN, which only the Primary Account Holder can change (T-Mobile Support, Help with T-Mobile account fraud). Product-specific

Other phone companies, and family plans

For any other company, call the number on your bill or open the company's own app, and ask three questions: does it offer a number lock or port-out protection, can you add a PIN or passcode that is required for changes, and who on the account can turn them off. Write the answers in the notes column of the account list, without the PIN itself. Ask your phone company

On a family or shared plan, the carrier's rules decide who may set and remove a lock. At T-Mobile the Primary Account Holder removes SIM Protection; at Verizon the Account Owner or a Manager makes changes. If someone else holds the account, ask them to turn the lock on for your line, or to make you a manager.

What the FCC rules do, and do not do yet

In 2023 the Federal Communications Commission (FCC) adopted rules on SIM swaps and port-outs (Federal Register, Protecting Consumers from SIM-Swap and Port-Out Fraud, published December 8, 2023). Once they apply, carriers must use secure methods to confirm it is you before moving your number to a new phone or a new company, tell you right away when someone asks for either, and offer you a lock that blocks both. The rules were published as effective January 8, 2024, except for listed sections "delayed indefinitely" until the FCC publishes an effective date. As of October 19, 2026 we found no such notice in the Federal Register. In July 2024 the FCC's Wireline Competition Bureau also granted part of an industry waiver request, so carriers do not have to comply with any of the rules until the FCC publishes a compliance date. The rules describe what carriers will owe you. For now, your carrier's own lock is the step that does something today. Ask your phone company

6. See it See it

Free pages from the companies and agencies themselves:

• Google Account Help, Turn on 2-Step Verification: Google's own steps, its view of each method and where prompts arrive.
• Apple Support, Two-factor authentication for Apple Account: how Apple's trusted devices and codes work.
• CISA, More than a Password: the agency's short case for two-step sign-in, with the names each company uses.

7. Practice Practice

Minimum: two-step sign-in on for the main email, its backup codes printed and put away, the phone company's lock on, and the account list marked. Time: about 30 to 45 minutes; the phone company step can take longer if you have to call. Materials: your phone; a computer or tablet if you prefer a larger screen; where your email password is kept (your password manager or book); a printer, or paper and a pen; the sign-in for your phone company's app or website, or its number from your bill; the account list and the recovery sheet.

1. Check recovery first. Open the recovery sheet and confirm the main email's recovery phone and email were checked in Getting back in. If not, do that first.
2. Turn on two-step for the main email. Follow the steps for your provider in section 3. Pick the prompt or app if offered.
3. Print the backup codes. Google: ten codes. Microsoft: one recovery code. Put the paper with your passport or other important papers.
4. Write where the paper is. On the recovery sheet, write the place in "printed codes kept." Do not write the codes.
5. Turn on the number lock. Follow your carrier's steps in section 5, or call the number on your bill and ask.
6. Mark the account list. For the main email, set two-step to the method you chose and backup codes printed to "yes." Add "number lock on" to the phone company row's notes.
7. Say the two rules aloud once. "I approve only a sign-in I started. I read a code to no one who called me."
8. Do the money accounts next. For each bank and card on the account list, follow the bank steps or call the number on the card.

8. Your setup Your setup

The box below reads your main email, your devices, what you said about two-step sign-in and your phone company. It shows the steps for those, and says which can wait.

9. Check your work Check your work

Criteria

• Does the account list show two-step on for the main email, with the method named?
• Are the backup codes or recovery code on paper, and does the recovery sheet say where, without the codes themselves?
• Is the phone company's lock on, and do you know who on the account can turn it off?
• Is the recovery phone on the main email a number you have now?
• Could you say, without looking, what you do with a prompt you did not start and a caller who asks for a code?
• Do the bank and card rows on the account list say two-step on, or "not yet" with a plan to ask the bank?

Worked example

Ruth's account list (fictional) shows Gmail with two-step "app or prompt" and backup codes printed "yes." Her recovery sheet's Gmail row says "folder with passport" under printed codes kept, and the recovery phone checked in Getting back in is her mobile number. Her phone company row's notes say whether the number lock is on, from the answer her phone company gives. The Saguaro Federal Credit Union row says "not yet: ask in the app." That meets the criteria for the main email and the phone number, and leaves the credit union open, with the person who settles it named. It does not show that Ruth can get back in if her phone is lost; under the assumption that the printed codes are where the sheet says, she has a way, and only a sign-in on another device settles it.

Common mistakes

• Turning on two-step before checking recovery. If the recovery phone is an old landline, a lost phone can mean a long wait or a lost account. Getting back in comes first for this reason.
• Saving the codes only on the phone. A photo or note of the codes on the phone you might lose does not help on the day you lose it. Paper, kept with important papers.
• Making a new set of codes and keeping the old printout. A new Google set cancels the old one. Throw the old page away and write the date of the new one on the recovery sheet.
• Tapping Yes to make prompts stop. That is what the sender is waiting for. Tap No, then change the password.
• Ticking "Don't ask again" on a shared computer. Leave it unticked anywhere you do not own the device.
• Assuming the FCC rules lock your number. Carriers do not yet have to comply. Turn on your carrier's own lock.

What is still unresolved

This chapter does not settle whether any account is safe, whether your bank offers more than text codes, or whether you can get back in on the day your phone is gone. Your bank or card company settles its own options. Your phone company settles which locks it offers and who may change them. The recovery steps in Getting back in and a printed code you can find settle the way back in, and When something goes wrong covers the day something goes wrong. Your phone and tablet covers the lock on the phone itself, which every passkey depends on.

10. Knowledge check and scenario

Checklist

• Two-step sign-in is on for my main email, with the strongest method it offered me.
• The backup codes or recovery code are printed and stored, and the recovery sheet says where.
• My phone company's number lock is on, or I have asked the company how to turn it on.
• The account list shows two-step and backup codes for the main email.
• Two-step is on, or asked about, for each bank and card account.
• I know the two rules: approve only a sign-in I started, and read a code to no one who contacted me.
• A passkey is made on my main email account. (Go deeper; optional)
• The text-code option is reviewed on accounts where another method has worked. (Go deeper; optional)