Turn On Two-Factor Authentication: Text Codes vs. Authenticator Apps vs. Security Keys
Note: Some future links on this site may be affiliate links. We never claim hands-on testing; guides are researched from the public sources listed in each article.
How we wrote this: A plain-English summary of the FTC's Use Two-Factor Authentication To Protect Your Accounts and CISA's Turn On MFA page (marked by CISA as archived content), checked October 29, 2026.
Two-factor authentication (2FA), also called two-step verification or multi-factor authentication (MFA), means a stolen password alone can't get someone into your account.
The three kinds of factors
The FTC groups them like this:
- Something you know: a password, PIN or security answer.
- Something you have: a one-time code from a text, an email or an app, or a security key.
- Something you are: a fingerprint or your face.
2FA requires factors from two different categories.
Comparing the common methods
| Method | How it works | FTC's take |
|---|---|---|
| Text or email code | A one-time code, usually 6 digits, that expires | Simple and better than nothing, but texts can be stolen in a SIM swap, and email codes are only as safe as your email |
| Authenticator app | An app on your phone shows a new code (CISA: every 30 seconds) or sends a push prompt | Safer than text, because it isn't exposed to SIM swaps |
| Security key | A physical USB or NFC key | The strongest method, because there's no code to steal |
Never share a verification code with someone who contacts you. That's a common scam.
How to turn it on
CISA's steps for each account or app:
- Open Settings, then your account or profile, then Security (or "Password and Security").
- Look for two-factor authentication, two-step verification or MFA, and turn it on.
- Choose a method and confirm.
The FTC notes 2FA is usually off by default.
Do these first
The FTC suggests starting with: email, bank, credit cards, social media, your tax filing site and payment apps, then shopping sites. If a site offers to "remember this device," say yes only on your own devices.
Save the backup or recovery codes somewhere safe. See account recovery setup. Next steps: strong passwords and passkeys.