Accounts and passwords
How to turn on two-factor authentication (2FA), step by step
By Brennan Decker. Published . Last reviewed . Every fact links to its source.
The short answer
Two-factor authentication (also called 2FA, multifactor authentication, or MFA) adds a second step when you log in. Even if someone steals your password, they can’t get past that step (CISA).
To turn it on: open the account’s settings, find the security section, and look for two-factor or two-step authentication (CISA).
Turn it on in three steps
- Go to settings. Look under your account profile for something like Account Settings or Profile, then the security settings (CISA).
- Find and turn on 2FA. It may be called two-factor authentication, two-step authentication, or something similar (CISA).
- Pick your second step from the options the account offers (CISA).
Your options for the second step
- A code by text or email (CISA).
- An authenticator app that makes a new code every 30 seconds (CISA).
- Your face or fingerprint (CISA).
- A security key (FTC).
Which accounts to start with
CISA suggests turning it on for every account that offers it, including banking, online shopping, social media, and email (CISA). Email is a good place to start. CISA describes how a scammer who got into one email account used it to reach linked bank and shopping accounts (CISA).
The one rule that keeps 2FA working
Never share a login code with anyone who contacts you. Scammers ask for these codes so they can get into your accounts (FTC). Apple, for example, says it will never ask for your two-factor code (Apple). More on verification code scams.
What to do if you already responded
- If you gave someone a code, change that account’s password right away and check that 2FA is still on (Apple, FTC).
- If you’re locked out, follow the FTC’s steps to recover a hacked account.
Common questions
Is 2FA the same as MFA or two-step verification?
They’re names for the same idea: a second step after your password. Accounts label it differently (CISA).
Is a text code good enough?
It’s one of the options CISA lists, and any second step is better than a password alone (CISA).
Should I ever give my 2FA code to someone?
No. Scammers ask for these codes to get into your account (FTC).
This page is general information, not legal or financial advice. If money already left your account, call your bank or card company first.