Enable Two-Factor Authentication and Plan for Recovery
Two-factor authentication adds another proof of identity beyond a password. The available methods and recovery process vary between services. When enabling it, think through both everyday sign-in and the situation where your phone, security key or usual device is unavailable. Good recovery planning supports security rather than weakening it.
Why it matters
An additional factor helps protect an account, but an unexpected prompt still needs scrutiny. Approving a request you did not initiate can give an attacker the access the second factor was intended to prevent.
A practical workflow
- Open the genuine service's security settings and review the authentication methods it currently supports.
- Choose a suitable method, favouring phishing-resistant options where available and practical for your situation.
- Store recovery codes securely according to the service's guidance and keep recovery contact details current.
- Test the normal sign-in process while preserving a trusted session until you confirm the setup works.
An example
A developer who uses an authenticator app should know what happens when their phone is replaced. Recovery codes or another supported factor may prevent an avoidable lockout, provided they are stored somewhere accessible to the owner and protected from others.
A mistake to avoid
Never share one-time codes with someone claiming to be support. Repeated approval prompts are also a reason to stop and investigate through the official account page, rather than approve a request just to make notifications disappear.
Try it and check the result
Review which factors and recovery methods are registered. Without disabling your working access, confirm that you understand the documented recovery path and can locate the information needed to use it.
Reference and further reading
NIST's multi-factor authentication guidance.
The workflows and examples in this guide are illustrative. Product controls and availability can change; check the linked official guidance for your setup.
Continue with Passkeys vs Passwords: What Changes When You Sign In? or explore all blog topics.