Two-step verification (also called two-factor authentication or 2FA) means signing in takes your password plus a second step, like a tap on your phone or a code. Even if a scammer gets your password, they can't get in without that second step. The key is to set up a backup first, so you don't get locked out.
⚡ The short version
- Check your recovery phone and backup email are up to date first.
- Turn it on in your account's security settings (steps below).
- Add a backup: backup codes, a second phone number or email, or an authenticator app.
- Never share a code with anyone who calls, texts or emails you.
Before you start: avoid getting locked out
- More than one way in. Microsoft strongly recommends having three pieces of security info on your account (for example, two email addresses and a phone number). It warns that if you lose your only one, getting back in can take 30 days, or you may lose the account.
- Print or save backup codes (Google) and keep them somewhere safe, like where you keep your passport.
- Changing phones or numbers? Update your account before you lose the old one.
Gmail (Google Account)
Turn it on
Open your Google Account (myaccount.google.com), select Security & sign-in, and under How you sign in to Google, select Turn on 2-Step Verification. Follow the steps on screen.
Use Google prompts
Google recommends prompts as your second step: a Yes / No message on your phone. It's easier than typing a code. If you get a prompt you didn't ask for, tap No.
Get backup codes
In the same 2-Step Verification page, under Backup codes, get a set of 10 codes and print or download them. Each code works once. If you lose your phone, sign in, choose Try another way, and enter a backup code.
Google says a newly added phone number can take up to 7 days to be trusted. Only tick Don't ask again on this computer on devices you use regularly and don't share.
Outlook.com, Hotmail and Live (Microsoft account)
Turn it on
Go to account.microsoft.com/security and sign in. Select Manage how I sign in, then under Two-step verification choose Turn on and follow the steps.
Add backup contact info
Microsoft suggests a second email address as a backup, plus a phone number or the Microsoft Authenticator app. Microsoft says it will start phasing out text-message (SMS) codes for personal accounts.
Older email apps may need an app password
If an older app or device says your password is wrong after you turn this on, it needs an app password. See Outlook keeps asking for a password.
iCloud Mail (Apple Account)
Apple says two-factor authentication is already on for most accounts. To check or turn it on, go to Settings → [your name] → Sign-In & Security on your iPhone or iPad (or System Settings on a Mac) and turn on two-factor authentication (follow the onscreen steps). Keep your trusted phone number current. You can also set up a recovery contact, someone you trust who can give you a code if you're ever locked out.
Already locked out? See Can't sign in to your email. Want a stronger password too? See Strong passwords you can actually remember.