Two-factor authentication (2FA) stops the single most common account takeover method: a stolen or reused password alone. The security benefit is well worth ten minutes per account — but people get locked out not because 2FA failed, but because they set it up in the wrong order and lost access to both their second factor and their backup codes at once.
01Choose an authenticator app over SMS where possible
SMS-based 2FA is better than no 2FA, but it's vulnerable to SIM-swapping — where an attacker convinces your carrier to transfer your number to their device. An authenticator app (Google Authenticator, Authy, or your password manager's built-in option) generates codes locally on your device instead, with nothing to intercept over the phone network.
02Save backup/recovery codes before you finish setup
Every major service gives you a set of one-time backup codes when you enable 2FA — usually shown exactly once, on the setup screen. This is the step people skip because it feels optional. It isn't: if you lose your phone, these codes are often the only way back into your account.
- Save them somewhere that isn't only on the same phone as your authenticator app — a password manager's secure notes feature, or printed and stored somewhere safe.
- Do not save them as a photo in your regular camera roll if that roll syncs to a cloud account protected by the same weak password you're trying to fix.
03Set up 2FA on your email account first
Most account recovery flows for other services route through email. If your email itself isn't secured with 2FA, it becomes the single point of failure for everything else — protect it first, before any other account.
04If you switch phones, migrate deliberately
Authenticator apps generate codes from a secret stored locally — moving to a new phone doesn't carry it over automatically unless you use the app's specific transfer or backup feature before wiping the old device.
- Google Authenticator: has a built-in "Export accounts" QR-transfer feature — use it before you factory-reset or hand over the old phone.
- Authy: backs up to the cloud (encrypted with a password you set) by default, which avoids this problem entirely.
05Use hardware keys for your most critical accounts
For accounts where a breach would be especially damaging (primary email, financial accounts, your password manager itself), a physical security key (like a YubiKey) is stronger than an app-based code, since it can't be phished — the key checks that it's talking to the real site before responding.