How to Set Up Two-Factor Authentication

Prepare

• Use a trusted device and network.
• Confirm the account email and password.
• Update recovery email and phone details.
• Have a password manager or safe paper storage ready for backup codes.

Set it up

1. Open the official account security page or app.
2. Choose two-factor, two-step or multi-factor authentication.
3. Prefer a passkey, security key or authenticator app where supported.
4. Complete the verification test.
5. Generate backup codes and store them away from the phone.
6. Review trusted devices and remove old ones.

Test without locking yourself out

Keep the current signed-in session open. Use a second browser or device to test the new method. Confirm that the backup route works before deleting any old authenticator entry.

Reject social engineering

Do not share a verification code, approve an unexpected prompt or scan a QR code sent by someone claiming to be support. Navigate to the account yourself.

Choose the factor by the threat and recovery needs

SMS is accessible but depends on the mobile number. Authenticator apps work without signal but require migration. Passkeys and security keys resist common phishing, but they also need a planned recovery route.

• Secure the primary email and password manager first.
• Add the strongest supported factor you can maintain reliably.
• Create at least one independent fallback and test it.
• Document the accounts that require special handling before changing phone.

Never scan a setup QR code into an unknown site or send it through a chat. It contains the secret used to generate future codes and should be treated like a credential.