Turn on two-factor login for email

Protect your email with a second login step, because whoever controls your email can reset most of your other accounts.

Close-up of a finger entering a passcode on a smartphone security screen. — Photo: indra projects / Pexels

Area: InformationFrom age 13Time to learn: 10 to 15 minutes

You will turn on two-factor login (also called 2-Step Verification or multi-factor authentication) for your email and save a backup way in.

SafetyIf you get a login prompt or code you did not request, deny it and change your password, because someone may have it.

Why it matters

Password resets for your bank, shopping, and social media accounts usually go to your email, so it is the key to the rest. With a second step, a stolen password alone is not enough to get in. In a year-long Google study, asking for confirmation through a prompt on the account owner's phone helped block 99% of bulk phishing attacks and 90% of targeted attacks.

In Google's year-long study of sign-in challenges, on-device prompts helped block 100% of automated bot attacks, 99% of bulk phishing attacks, and 90% of targeted attacks on accounts; SMS codes sent to a recovery phone blocked 100%, 96%, and 76%.

Source: Google Security Blog, 'New research: How effective is basic account hygiene at preventing hijacking', 2019.Measured

How to do it

Have your phone with you and know your current email password.
Gmail: open your Google Account, tap Security & sign-in, and under 'How you sign in to Google' select Turn on 2-Step Verification. Follow the on-screen steps.
Outlook or Hotmail: go to account.microsoft.com/security, select 'Manage how I sign in', then under Additional security find Two-step verification and choose Turn on.
Other email providers: open account Settings, then Security, and look for 'two-factor', 'two-step', or 'multi-factor'.
Choose your second step. Strongest: a passkey or security key. Next: an app prompt or authenticator app. A text message code is weaker but still much better than a password alone; some providers, such as Microsoft, are phasing out text codes for personal accounts.
Save your backup codes if offered. Print or write them down and keep them somewhere safe, not inside the same email account.
Add a recovery phone number and a recovery email address that you control. Microsoft recommends having three ways to prove it is you, because losing your only second step can lock you out.
Sign out and sign back in on another device to confirm the second step works.

Common mistakes

Not saving backup codes, then getting locked out after losing your phone.
Approving a sign-in prompt that you did not start.
Reading a login code to someone who calls or texts you. Real companies and police never ask for verification codes.
Stopping at email. Turn it on for your bank and social media next.

You can do this when …signing in to your email on a new device asks for a second step, and you know where your backup codes are.