Staying Safe Online · Passwords & Sign-ins · Lesson 4 of 5

Two-Step Verification

Add a second lock to your accounts, and keep your sign-in codes to yourself.

A second lock on the door

Two-step verification means signing in takes two things instead of one. First you type your password. Then you prove it's you a second way. You may also see it called two-factor authentication, 2FA or multi-factor authentication. They all mean the same idea.

The second step is usually a short code, a few numbers that work only once and only for a few minutes. It can come in two main ways:

• By text message. The site sends the code to your phone.
• By an app. An authenticator app is a free phone app, like Microsoft Authenticator or Google Authenticator. It shows a new code every 30 seconds, or asks you to tap "Approve".

Why bother? Because a stolen password is no longer enough. A criminal in another country may have your password, but they don't have your phone. Microsoft has reported that this extra step blocks more than 99% of attacks that try to take over accounts.

To turn it on, sign in to the account and look in Settings or Security for "Two-step verification" or "2-Step Verification". Follow the steps on the screen.

Start with your email account, then your bank and any shopping sites with your card saved.

It adds a few seconds when you sign in on a new device. Most sites will remember your own computer, so you won't be asked every time.

Never share a code

Here is the most important rule in this module. Never give a sign-in code to anyone who contacts you.

Criminals know about two-step verification. So they try to get the code from you. A common trick goes like this:

1. Someone calls or texts. They say they're from your bank, Microsoft, Amazon or even a friend.
2. They say there's a problem, and they need to "confirm it's you".
3. A code arrives on your phone. They ask you to read it out.

That code was for signing in to your account. If you read it out, you hand them the key.

Real companies will never call and ask for that code. If anyone asks, hang up. You did nothing wrong by answering the phone. If you're worried, call the company back using the number on its real website or your card.

If you get a code you didn't ask for, someone may be trying your password. Don't share it, and change that password soon.

You may also hear about passkeys. A passkey is a newer way to sign in with no password at all. Your phone or computer keeps a secret key, and you unlock it with your fingerprint, face or PIN. A passkey only works on the real site, so it can't be tricked out of you on a fake one. If a site offers a passkey, it's a good choice.