# Turn On Two-Step Verification for Google, Microsoft and Apple Accounts

> Step-by-step instructions to turn on two-step verification for a Google Account, a Microsoft account and an Apple Account, with advice on which second step to choose and how to avoid lockout.

Source: https://www.epifive.com/blog/enable-two-step-verification-google-microsoft-apple · Published 2026-10-28 · EpiFive

## Key takeaways

- Turn on two-step verification for your main email account first, because it is used to reset the passwords of other accounts.
- Google says passkeys and security keys give the strongest phishing protection, and text or voice codes are vulnerable to phone-number attacks.
- Microsoft recommends registering three pieces of security info and says it is phasing out SMS for personal accounts.
- Apple two-factor authentication is on by default for most accounts and usually cannot be removed once enabled.

Turn on two-step verification (also called two-factor authentication, 2FA) in the security settings of each account: for Google at myaccount.google.com under Security, for Microsoft at account.microsoft.com/security, and for Apple in Settings, then your name, then Sign-In & Security. After that, a stolen password alone cannot open the account. Start with the email account you use to reset other passwords, and register a backup method before you sign out anywhere.

## Who this is for

This guide is for individuals who own a personal Google Account, Microsoft account or Apple Account and want to protect them from account takeover. It does not cover work or school accounts managed by an administrator; those follow your organisation's policy. By the end, each account will need a second proof at sign-in, and you will have a recovery method in case you lose your phone.

## How two-step verification works

You sign in with something you know (the password) and then prove something you have (a phone, a security key or a code from an app). An attacker who phished or guessed your password still cannot finish the sign-in.

Second steps are not equal. Google's help page describes these second steps, roughly from strongest phishing protection to weakest:

| Second step | Notes from the provider |
| --- | --- |
| Passkeys and hardware security keys | Strongest protection against phishing |
| Google prompts | Google's recommended option if you do not use a passkey; you approve on a signed-in phone |
| Authenticator or code apps | One-time codes that work without mobile service |
| Text or voice codes | Code sent to your phone; vulnerable to phone-number-based attacks |
| Backup codes | Eight-digit codes for use if you lose your phone; store them safely |

Choose the strongest option you will actually use, and keep one fallback.

## Before you start

- Use a device you control and a network you trust.
- Have your phone in hand. Make sure it has a screen lock.
- Decide where you will keep backup codes: a locked drawer or a password manager, not a note on the same phone.
- If you are asked to sign in during setup, type the address of the service yourself rather than following a link in a message.

## Google Account

Google's help page gives these steps for a computer:

1. Go to your Google Account at myaccount.google.com.
2. Open the Security section (labelled Security & sign-in).
3. Under How you sign in to Google, choose Turn on 2-Step Verification.
4. Follow the on-screen prompts.

Points to note from the same page:

- If the account is managed by work, school or another group, these steps may not work; ask your administrator.
- A newly added phone number may take up to 7 days to become trusted. Adding a trusted passkey or security key can speed this up.
- If Google flags a new 2-Step Verification phone number as suspicious, it disables the number and notifies you. You have 30 days to confirm it.
- Passkeys skip the separate second step because they verify that you have your device.

After turning it on, add a second method in case your phone is lost. Generate backup codes and store them somewhere safe. Consider adding a passkey as well; the guide to [passkeys](https://www.epifive.com/blog/passkeys-explained-how-to-set-up) shows how.

## Microsoft account

For a personal Microsoft account, Microsoft's support article "How to use two-step verification with your Microsoft account" describes this path:

1. Sign in to the Security tab of your Microsoft account at account.microsoft.com/security.
2. Select Manage how I sign in.
3. Under Additional security, find Two-step verification and choose Turn on.
4. Follow the on-screen prompts, which include scanning a QR code with your phone to set up the Microsoft Authenticator app.

Notes from that article:

- Microsoft recommends having three pieces of security info on the account in case one is lost.
- Losing your contact method can cost you up to 30 days of access, according to the article.
- Microsoft says it is phasing out SMS as a method of authentication and account recovery for personal Microsoft accounts, so prefer an authenticator app.
- Some apps and devices cannot accept regular security codes and need an app password, which is available only after two-step verification is on.

Menu labels on the Microsoft page change from time to time. If a label differs, look for the two-step verification option under the Security area of your account.

## Apple Account

Apple's support article on two-factor authentication for Apple Account gives these routes:

- **On an iPhone or iPad:** open Settings, choose your name, then Sign-In & Security, and turn on two-factor authentication.
- **On a Mac:** open System Settings, choose your name, then Sign-In & Security, and turn it on.
- **On the web:** go to account.apple.com and sign in. You may need to enter a code sent to your email or answer security questions. Then choose Upgrade Account Security and follow the prompts.

How it works: you need your Apple Account password and a six-digit verification code shown on your trusted devices or sent to your trusted phone number. Apple says two-factor authentication is the default security method for most accounts, and that some features, such as Apple Pay and Sign in with Apple, require it.

Apple also says that if your account was created with two-factor authentication, the extra protection cannot be removed. If you turned it on recently, you can lower the account security within two weeks of enrolling. Apple's page points to a separate article for trusted devices and trusted phone numbers; check it to make sure the number listed is one you still control.

## Prevent lockout

The most common problem is losing the only second step. Reduce the risk before it happens.

1. **Register two methods.** For example, an authenticator app and backup codes for Google; three security info items for Microsoft; a trusted device and a trusted phone number for Apple.
2. **Keep your phone number current.** If you change number, update it on each account before giving up the old SIM.
3. **Store backup codes safely.** Print them or keep them in a password manager, separate from the phone.
4. **Know the recovery path.** Each provider has an account recovery page; read it now rather than during a crisis.
5. **Do not share codes.** No genuine support agent or official will ask for a verification code. See [Fake Customer Care Number Scams](https://www.epifive.com/blog/fake-customer-care-number-scam-how-to-avoid) for a common way these codes are stolen.

## Verify that it works

For each account:

1. Open a private or incognito browser window.
2. Sign in with your password.
3. Confirm that the service asks for the second step.
4. Check the account security page for the list of registered methods and trusted devices, and remove devices you do not recognise.

## Troubleshooting

| Problem | What to try |
| --- | --- |
| No code arrives by text | Check signal and the number on file; try another method, such as an app or backup code |
| Google does not accept a new number yet | A new number can take up to 7 days to become trusted per Google's page; use another method meanwhile |
| An older app cannot sign in to a Microsoft account | Microsoft's article describes app passwords for apps that do not support the extra step |
| You cannot find the Apple setting | The account may already use two-factor authentication, which is the default for most accounts |

## Summary checklist

- Turn on two-step verification for your main email account first.
- Choose the strongest second step you will use: passkey or security key, prompts, authenticator app, then SMS.
- Register at least one backup method for each account.
- Store backup codes away from your phone.
- Test the sign-in in a private window.
- Never read a verification code to anyone who contacts you.

## References

- Google Account Help, Turn on 2-Step Verification: https://support.google.com/accounts/answer/185839
- Microsoft Support, How to use two-step verification with your Microsoft account: https://support.microsoft.com/en-us/help/12408
- Apple Support, Two-factor authentication for Apple Account: https://support.apple.com/en-us/102660

## Frequently asked questions

### Which second step is best for a Google Account?

Google's help page says passkeys and hardware security keys offer the strongest protection against phishing, and recommends Google prompts if you do not use a passkey. Text or voice codes are described as more vulnerable to phone-number-based attacks.

### Can I turn off two-factor authentication on my Apple Account?

Usually not. Apple says that if your account was created with two-factor authentication, the extra protection cannot be removed. If you turned it on recently, you can go back within two weeks of enrolling.

### What if I lose my phone and cannot get the code?

Use another registered method, such as backup codes for Google, or the other security info on your Microsoft account. This is why each service recommends having more than one method registered before you need it.

### Is SMS two-step verification still worth turning on?

Yes, it is better than a password alone, but it is the weakest second step. Prefer an authenticator, a prompt on your signed-in phone or a passkey where available, and keep SMS only as a fallback.