01 · Accounts
Turn on two-step sign-in for your email
Your email can reset many of your other passwords. Protect it first.
Why it matters
Your inbox is often the way back into your other accounts. Someone who gets into it may be able to reset passwords elsewhere. Two-step sign-in adds a check beyond a password. Start with the email address you use for banking and account recovery.
If someone may already be in your account, use the emergency checklist first.
The steps
Menu names vary. Look in your email account's security settings, rather than only the settings of the app you use to read mail. For a work or school account, follow your organization's instructions.
Open the account yourself
Use your usual email app or a saved bookmark. Open Account, then Security or Sign-in. Look for two-step verification, two-factor authentication, or multifactor authentication (MFA). Do not follow a sign-in link in an unexpected message.
Pick the strongest method you can use reliably
If offered, a passkey or security key provides protection against fake sign-in pages. A passkey may replace the password rather than appear as a separate second step; follow the account's setup instructions.
Otherwise, use an authenticator app, which generates short-lived codes. If text messages are the only practical option, use them: they are better than a password alone. You can improve the method later. A physical security key may cost money; it is not required to get started.
Follow the setup and finish the confirmation
For an authenticator app, scan the setup QR code inside the app, then enter the code it generates into the account's setup page. Keep that QR code private: it is a secret used to generate your codes.
For a passkey, security key or text-message method, complete the prompts shown by the account. Continue until its security page confirms the method is enabled. Starting enrollment is not the same as finishing it.
Make a way back in
Check that your recovery phone and recovery email are current. Protect the recovery email too.
Save the account's backup or recovery codes if it offers them. Print them or write them down and put them somewhere private. Do not keep the only copy in the inbox you are protecting or on the phone you might lose. Register a second supported method if you have one.
Test without closing your working session
Keep your current session open. In a private browser window on your own device, open the account's real sign-in page and try signing in. Confirm the new method works, then sign out of that test window.
If it fails, use the still-open security settings to fix it before removing any old sign-in method.
An unexpected approval request means stop
Decline sign-in requests you did not start. Never read a code to an unexpected caller or paste it into a page opened from their message. Codes can still be stolen by phishing. A push notification is not proof that the person requesting access is you.
Before changing phones
Check how your sign-in method transfers or recovers before erasing the old phone. Set up and test the replacement while the old device still works. Keep recovery codes available separately.
Common questions
Will I need the extra step every time?
Not necessarily. Your account may remember a device. Only choose that option on a device you control, with a screen lock. A remembered session is still valuable to an attacker, so keep the device updated and locked.
What if I lose my phone?
Use your saved recovery codes, second method or the provider's official account-recovery process. Recovery rules differ. Do not pay a stranger who promises to unlock your account.
What if there is no two-step option?
Check the account's official help. Use a unique password and secure its recovery address. For a managed account, ask the administrator which sign-in protections are available.
You're done when
The account confirms protection is enabled, you have completed a test sign-in, and a recovery method is available without relying on the same phone or inbox.
Sources and review
Source check: November 6, 2026. These are general instructions; the labels and recovery options in your account may differ.
Do next
02 · Set up a password manager