Multi-factor authentication and passkeys

Choose stronger sign-in protection

Multi-factor authentication (MFA), sometimes called two-step verification, adds a check beyond a password. A passkey uses a cryptographic credential, usually unlocked with your device PIN or biometrics, and is designed to resist fake sign-in websites. Use a passkey when your service supports it.

If you use a password, add MFA. A security key or passkey offers protection against phishing that a typed one-time code does not. An authenticator app is useful when those options are unavailable. SMS verification is still preferable to a password alone, but depends on keeping control of your mobile number.

Set it up without locking yourself out

Open the service's official app or type its known web address. Look under account, security or sign-in settings.
Choose an available passkey or MFA method. Register it only on a device or credential manager you control.
Add an independent backup method if the service permits. Save recovery codes in a protected location outside your everyday phone.
Test a new sign-in before removing your old method. Check how recovery works before replacing a device.

Recognise an authentication trap

A caller may ask for a code to “cancel fraud”, or keep sending approval prompts until you accept. Never share codes, scan a sign-in QR code sent by a stranger or approve a request you did not start. An authenticator code can still be stolen through a convincing fake page.

If your authenticator or phone is lost

Use the provider's official recovery process and your stored backup method. Revoke the lost device's access and register a replacement. Secure the cloud account that syncs your passkeys too. Do not pay someone offering to bypass account recovery.

Common question: can I use one phone?

Yes, many services support this. The important part is having a recovery option that survives losing that phone. Never store your only backup codes as unprotected screenshots on it.