Almost every account you care about is protected by a password you have typed hundreds of times. That is the weak point. Two-factor authentication (2FA) adds a second requirement — a code from an app, a tap on your phone, a physical key — so a stolen password on its own is not enough to get in.

The catch is that 2FA only helps when it is set up properly. A half-finished setup with no backup codes can lock you out of your own inbox at the worst possible moment. Work through the checklist below in order. The accounts at the top matter far more than the ones at the bottom.

Start where a password reset lands

Your email inbox is the master key to everything else. If someone gets into it, they can request a reset link for your bank, your social accounts, your cloud storage and your shopping history, then delete the evidence as it arrives. Secure email before anything else — Gmail, Outlook, iCloud Mail, Proton Mail, or whatever your provider is.

If your email is a work account, your IT team may control the 2FA settings, so ask before changing anything. For personal accounts, you are on your own, which is exactly why it is worth doing first. A sensible order of work looks like this:

1. Primary email account
2. Banking and payment apps
3. Password manager
4. Main social and messaging accounts
5. Cloud storage, and any account holding your ID documents
6. Everything else, over time

Pick the right kind of second factor

Not all second factors are equal. Text-message codes are the weakest common option: they can be intercepted, and phone numbers can be reassigned or taken over. They are still far better than nothing, but treat them as a stepping stone rather than the destination.

• Authenticator app. Generates six-digit codes on your device every 30 seconds and works offline. This is the sensible default for most people.
• Passkeys and hardware keys. The strongest option. A passkey or a physical security key ties the login to a device you hold, and it resists the fake login pages that ask you to type a code.
• SMS or voice call. Better than a password alone, but vulnerable to number takeovers and to network problems.
• Email codes. The weakest of the lot, because if your email is compromised, the second factor goes with it.

Popular authenticator apps include Google Authenticator, Microsoft Authenticator, Authy, 1Password and Aegis. Any of them will do. What matters more is where you keep the app, and whether you have a way back in if you lose the device.

Set up the authenticator app carefully

The setup is short, but the order of steps matters. Rush it and you can remove your old method before the new one works.

1. Install the authenticator app on the phone you always carry.
2. Sign in to the account you are securing and open its security settings.
3. Choose the authenticator app option and scan the QR code shown.
4. Enter the six-digit code to confirm the app and the account are talking to each other.
5. Save the backup codes before you close the page.
6. Only then remove any weaker method, such as SMS, if the account allows it.

If you use more than one device

Codes live on one phone, so a lost, broken or wiped handset is a genuine problem. Some apps let you export or sync codes to a second device or into a password manager; others do not. If yours does, set that up deliberately rather than discovering the limitation on holiday. If it does not, your backup codes are the safety net.

Look after the backup codes

Backup codes are single-use passwords that get you past 2FA when your phone is unavailable. They are the difference between a mildly annoying evening and a week of account recovery forms.

Where to put them: a password manager entry, a printed sheet in a drawer, or a sealed envelope with someone you trust. Where not to put them: a note inside the email account they protect, a screenshot in your camera roll, or a message to yourself in a chat app. Keep them separate from the password itself. A printed sheet in a locked drawer is a perfectly reasonable solution, and it is one you will actually find again.

If an account shows you the codes only once, that is not a suggestion. Save them there and then, before you do anything else.

Check the recovery settings, then test

Attackers rarely fight 2FA head-on. They use the doors you left open. Spend five minutes on each account looking at:

• Recovery email and phone number. Delete old addresses and numbers you no longer use.
• Trusted devices and active sessions. Sign out anything you do not recognise.
• App passwords and connected third-party apps. Revoke the ones you have stopped using.
• Security notifications. Switch them on so you hear about new sign-ins.

Then test it. Sign out, sign back in, and confirm the code arrives and works. Doing this now means you find out about a broken setup while you are calm, rather than while you are trying to pay a bill or board a flight.

Make this week's job a small one

You do not need to secure thirty accounts tonight. Pick your email, spend fifteen minutes adding an authenticator app, save the backup codes somewhere physical, and check the recovery address. That single account is the one that matters most, because it is the one that can reset all the others.

Next week, do your bank and your password manager. After that, your main social accounts, where a hijack does its damage to your friends and family rather than to your money. If something looks wrong on a financial account, contact the bank directly through its app or the number printed on your card — never a link or phone number from a message, however convincing it looks.

One habit worth building: whenever you switch on 2FA for an account, note down where you stored the backup codes. Future you, standing in an airport with a dead phone, will be grateful.

Photo: Schluesseldienst / Pixabay