Turn on two-step verification (also called two-factor authentication, 2FA) in the security settings of each account: for Google at myaccount.google.com under Security, for Microsoft at account.microsoft.com/security, and for Apple in Settings, then your name, then Sign-In & Security. After that, a stolen password alone cannot open the account. Start with the email account you use to reset other passwords, and register a backup method before you sign out anywhere.
Who this is for
This guide is for individuals who own a personal Google Account, Microsoft account or Apple Account and want to protect them from account takeover. It does not cover work or school accounts managed by an administrator; those follow your organisation's policy. By the end, each account will need a second proof at sign-in, and you will have a recovery method in case you lose your phone.
How two-step verification works
You sign in with something you know (the password) and then prove something you have (a phone, a security key or a code from an app). An attacker who phished or guessed your password still cannot finish the sign-in.
Second steps are not equal. Google's help page describes these second steps, roughly from strongest phishing protection to weakest:
| Second step | Notes from the provider |
|---|---|
| Passkeys and hardware security keys | Strongest protection against phishing |
| Google prompts | Google's recommended option if you do not use a passkey; you approve on a signed-in phone |
| Authenticator or code apps | One-time codes that work without mobile service |
| Text or voice codes | Code sent to your phone; vulnerable to phone-number-based attacks |
| Backup codes | Eight-digit codes for use if you lose your phone; store them safely |
Choose the strongest option you will actually use, and keep one fallback.
Before you start
- Use a device you control and a network you trust.
- Have your phone in hand. Make sure it has a screen lock.
- Decide where you will keep backup codes: a locked drawer or a password manager, not a note on the same phone.
- If you are asked to sign in during setup, type the address of the service yourself rather than following a link in a message.
Google Account
Google's help page gives these steps for a computer:
- Go to your Google Account at myaccount.google.com.
- Open the Security section (labelled Security & sign-in).
- Under How you sign in to Google, choose Turn on 2-Step Verification.
- Follow the on-screen prompts.
Points to note from the same page:
- If the account is managed by work, school or another group, these steps may not work; ask your administrator.
- A newly added phone number may take up to 7 days to become trusted. Adding a trusted passkey or security key can speed this up.
- If Google flags a new 2-Step Verification phone number as suspicious, it disables the number and notifies you. You have 30 days to confirm it.
- Passkeys skip the separate second step because they verify that you have your device.
After turning it on, add a second method in case your phone is lost. Generate backup codes and store them somewhere safe. Consider adding a passkey as well; the guide to passkeys shows how.
Microsoft account
For a personal Microsoft account, Microsoft's support article "How to use two-step verification with your Microsoft account" describes this path:
- Sign in to the Security tab of your Microsoft account at account.microsoft.com/security.
- Select Manage how I sign in.
- Under Additional security, find Two-step verification and choose Turn on.
- Follow the on-screen prompts, which include scanning a QR code with your phone to set up the Microsoft Authenticator app.
Notes from that article:
- Microsoft recommends having three pieces of security info on the account in case one is lost.
- Losing your contact method can cost you up to 30 days of access, according to the article.
- Microsoft says it is phasing out SMS as a method of authentication and account recovery for personal Microsoft accounts, so prefer an authenticator app.
- Some apps and devices cannot accept regular security codes and need an app password, which is available only after two-step verification is on.
Menu labels on the Microsoft page change from time to time. If a label differs, look for the two-step verification option under the Security area of your account.
Apple Account
Apple's support article on two-factor authentication for Apple Account gives these routes:
- On an iPhone or iPad: open Settings, choose your name, then Sign-In & Security, and turn on two-factor authentication.
- On a Mac: open System Settings, choose your name, then Sign-In & Security, and turn it on.
- On the web: go to account.apple.com and sign in. You may need to enter a code sent to your email or answer security questions. Then choose Upgrade Account Security and follow the prompts.
How it works: you need your Apple Account password and a six-digit verification code shown on your trusted devices or sent to your trusted phone number. Apple says two-factor authentication is the default security method for most accounts, and that some features, such as Apple Pay and Sign in with Apple, require it.
Apple also says that if your account was created with two-factor authentication, the extra protection cannot be removed. If you turned it on recently, you can lower the account security within two weeks of enrolling. Apple's page points to a separate article for trusted devices and trusted phone numbers; check it to make sure the number listed is one you still control.
Prevent lockout
The most common problem is losing the only second step. Reduce the risk before it happens.
- Register two methods. For example, an authenticator app and backup codes for Google; three security info items for Microsoft; a trusted device and a trusted phone number for Apple.
- Keep your phone number current. If you change number, update it on each account before giving up the old SIM.
- Store backup codes safely. Print them or keep them in a password manager, separate from the phone.
- Know the recovery path. Each provider has an account recovery page; read it now rather than during a crisis.
- Do not share codes. No genuine support agent or official will ask for a verification code. See Fake Customer Care Number Scams for a common way these codes are stolen.
Verify that it works
For each account:
- Open a private or incognito browser window.
- Sign in with your password.
- Confirm that the service asks for the second step.
- Check the account security page for the list of registered methods and trusted devices, and remove devices you do not recognise.
Troubleshooting
| Problem | What to try |
|---|---|
| No code arrives by text | Check signal and the number on file; try another method, such as an app or backup code |
| Google does not accept a new number yet | A new number can take up to 7 days to become trusted per Google's page; use another method meanwhile |
| An older app cannot sign in to a Microsoft account | Microsoft's article describes app passwords for apps that do not support the extra step |
| You cannot find the Apple setting | The account may already use two-factor authentication, which is the default for most accounts |
Summary checklist
- Turn on two-step verification for your main email account first.
- Choose the strongest second step you will use: passkey or security key, prompts, authenticator app, then SMS.
- Register at least one backup method for each account.
- Store backup codes away from your phone.
- Test the sign-in in a private window.
- Never read a verification code to anyone who contacts you.
References
- Google Account Help, Turn on 2-Step Verification: https://support.google.com/accounts/answer/185839
- Microsoft Support, How to use two-step verification with your Microsoft account: https://support.microsoft.com/en-us/help/12408
- Apple Support, Two-factor authentication for Apple Account: https://support.apple.com/en-us/102660
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.