Two-factor authentication

Websites get broken into all the time, and the passwords people used on them get out (EFF). Two-factor authentication means a stolen password isn’t enough to get into an account: whoever has it still needs something only you have, such as your phone or a small key. Getting hijacked accounts back is the emergency Access Now’s helpline has handled most often (Access Now), and the first thing its report advises is turning on two-factor.

What two-factor is

Two-factor authentication adds a second check after your password: a code from an app, a tap on a small key or a prompt on your phone. It works like a bank card and its PIN, where one is no use without the other (EFF). Services call it different things, such as two-step verification, multi-factor authentication or 2FA, but the idea is the same (EFF; Security in a Box).

It doesn’t replace a strong password. Use both: a different password for every account, kept in a password manager, and two-factor on top (EFF).

Stronger and weaker kinds

Some kinds of two-factor stop attackers who have built a fake sign-in page; others don’t.

Can’t be fooled by a fake page

• A security key is a small physical key that you plug into a laptop or phone, or tap against it. It only works on the real website, so a fake sign-in page gets nothing from it (EFF). Register two and keep the spare locked away in case one is lost (NDI), and check that a key works with your phone before you buy it (Security in a Box).
• A passkey is a newer way to sign in, kept on your phone, laptop or security key, that replaces the password and the code together. It won’t work on a fake site either. Passkeys are strong and easy when they work, but not every service offers them yet (EFF). Many phones unlock passkeys with a fingerprint or face and copy them to the cloud; for sensitive accounts, Security in a Box suggests keeping them on a security key or on the device itself, locked with a passphrase (Security in a Box).

Good, but a fake page can trick you

• An authenticator app is an app on your phone that shows a new six-digit code every 30 seconds (EFF). It works without a phone signal or data (Access Now), but someone can still be tricked into typing the code into a fake page (NDI). Security in a Box suggests free, open-source apps such as Aegis on Android and Proton Authenticator, which works on phones and computers (Security in a Box).
• A phone prompt asks whether it’s you trying to sign in. Only say yes if you’ve just tried to sign in yourself (NDI).

Weakest

Codes sent by text message can be intercepted, or redirected to someone else’s phone through a SIM swap (below). They don’t arrive without a signal, or abroad without roaming, and they tie your phone number to the account (EFF; Security in a Box). Still, text messages are better than nothing when they’re all a service offers (EFF).

In a case Amnesty International documented, human rights defenders in Uzbekistan were sent fake Gmail sign-in pages that asked for their password and their two-factor code (NDI). A group that supports journalists in Eastern Europe described helping a Belarusian organisation after a phishing attack in 2024:

The attack was successful because they had not yet implemented phishing-resistant two-factor authentication.

A survey respondent, New America’s Defending the Defenders, 2025

That group now helps organisations set up security keys. Google’s Advanced Protection Program, which Access Now’s helpline suggests for anyone at high risk of having their account hijacked, requires a passkey or a security key to sign in (Google; Access Now). Phishing shows how to spot a fake sign-in page.

What each account offers

How strong a kind of two-factor is, and whether a service offers it, are separate questions. Some services only offer text messages. Some apps, open-source ones among them, don’t accept security keys at all. So use the strongest kind each account offers (EFF). 2FA Directory lists what each service supports.

Messaging apps work differently. WhatsApp’s two-step verification and Signal’s Registration Lock are PINs that stop anyone registering your number on another phone without them. Turn both on, add an email address to WhatsApp’s so a forgotten PIN can be reset, and keep Signal’s in your password manager, since Signal can’t reset it (Security in a Box; Security in a Box).

Where a service only offers text messages, use them, and protect your number as below.

SIM swaps

A SIM swap is when someone gets your phone number moved onto a SIM card they control, usually by tricking your mobile operator, sometimes with help from someone who works there. From then on, every code sent by text goes to them, and they can reset any password that’s reset by text (EFF).

Ask your mobile operator whether they can put a PIN or password on changes to your number (EFF; SIIRF), and move your important accounts off text messages. If your phone suddenly shows “No service” while phones around you have signal, call your operator from another phone and warn your bank (SIIRF).

Where to start

Turning it on everywhere at once is a lot, so go one account at a time (EFF):

1. Email first. Most services reset passwords through email, so whoever has your email can get into everything else (EFF).
2. Then the account that backs up your phone. That’s your Apple, Google or Microsoft account (EFF).
3. Then your password manager. If it keeps your passwords online, it needs two-factor too (Password management).
4. Social media and messaging. Social media accounts covers the ones your organisation speaks through.
5. Then money, files and the rest. That means bank and mobile money apps, file storage and any account that holds sensitive information (Security in a Box).

Backup codes, so nobody gets locked out

The risk with two-factor is locking yourself out: a lost phone, a new number or a trip abroad can stop the codes reaching you (EFF). Plan for that when you turn it on.

• Save the backup codes. Most services give you a short list of backup codes when you turn on two-factor: spare codes that each work once, for when your phone or key isn’t with you (EFF). Some services, Facebook among them, call them recovery codes (Security in a Box). Anyone who has them can get in, so keep them apart from the password: in a separate password file, or printed and locked away (Security in a Box).
• Add a second way in. Where the service allows it, register a spare key or a second device (Security in a Box).
• Back up the app carefully. If your authenticator app offers a backup, check that it’s protected by a password you set, so the company storing it can’t read it (EFF).
• Check before a trip or a new number that you can still sign in, since text-message codes may not reach you abroad (Security in a Box). Travel and border crossings has more.
• Leave it on. Some services let you pause two-factor for convenience; don’t (Security in a Box).

For the organisation’s own accounts, two trusted people hold the backup codes, so no single person is the only way back in. Shared accounts explains how.

Bringing your team with you

1. Start with the accounts the organisation can least afford to lose. That means the shared email, the people who manage your social media, finance and any account that controls the others (SIIRF).
2. Explain the kinds before people choose. Then nobody thinks a text message is as good as an app or a key.
3. On Google Workspace or Microsoft 365, an admin can require it. In Google Workspace, tell people it’s coming, let them turn it on, ask everyone to enrol and track who has, then switch it on for everyone; Google already requires it for admin accounts (Google). In Microsoft 365, the free security defaults make everyone register with the Microsoft Authenticator app; tell people before you switch them on (Microsoft).
4. On personal accounts, which is most small teams, run a setup session. Turn it on for your own accounts and the director’s first, so you know where the settings are. In the session, everyone turns it on for their email together and saves the backup codes, then adds one more account each week.
5. Expect lockouts in the first weeks. Make sure each person knows where their backup codes are and who to ask, and keep the team chat open for questions.
6. Buy security keys if you can. Give everyone two, starting with the people most likely to be targeted. If keys aren’t in the budget, use authenticator apps rather than text messages (NDI).
7. Make it part of joining and leaving. A new colleague sets up two-factor in their first week. When someone leaves, take their phone or key off any account you share (Shared accounts).
8. Check every three months. Make sure two-factor is on for everyone’s email and every shared account. Checklists and audits has the rest of the quarterly check.

If it’s already happened

• A phone or key is lost: sign in with a backup code or your spare key, make a new set of backup codes and set up two-factor on the new phone (EFF). If the phone held work accounts, follow Device lost or seized.
• Someone read out a code to a caller: the caller was the attacker. Attackers use the promise of two-factor to trick people into handing over reset codes (Access Now). Follow Account taken over straight away.
• The phone suddenly shows “No service”: it may be a SIM swap. Account taken over covers what to do.

Teach it to your team

A 30-minute session for your next team meeting.

• Prepare: look up your main accounts on 2FA Directory to see which kinds each one offers, and choose the authenticator app you’ll suggest. Ask everyone to bring their phone, charged, and to know their email password.
• Exercise: everyone turns on two-factor for their email, with the app where it’s offered, saves the backup codes somewhere safe, then signs out and back in to check it works.
• Three questions: Which kinds of two-factor can’t be fooled by a fake sign-in page? A caller says a code reached you by mistake and asks you to read it back: what do you do? Where are your backup codes?
• Afterwards: help anyone who’s stuck one to one, answer questions in the team chat and add one more account each week.