Your bank, email and mobile accounts are the keys to your money. A strong password is a good start, but passwords leak, get reused and get guessed. A second step turns a stolen password into a dead end.
Which second step?
| Method | How it works | Strength | Watch out for |
|---|---|---|---|
| Text message code | A code arrives on your phone number | Basic | Can be intercepted if someone takes over your number |
| Authenticator app | A code is made on your phone, offline | Strong | Move it carefully when you change phones |
| Security key | A small device you plug in or tap | Very strong | Keep a spare key |
| Passkey | Your device proves who you are, no password typed | Very strong | Needs a supported service and a synced device |
Set it up in five steps
Start with email and bank
They unlock everything else. Turn on the strongest option each offers.
Choose an authenticator app or passkey
Prefer these to text codes where you have the choice.
Save the recovery codes
Print them or store them in a password manager, not in the same email account.
Register a second device
A spare phone or a security key means a lost phone is an inconvenience, not a crisis.
Use a password manager
Create a long, unique password for each account, so one leak does not spread.
Good habits
- Passkey or authenticator wherever offered
- A unique, long password for each service
- Recovery codes stored offline
Habits to avoid
- Reusing one password across services
- Sharing codes with anyone, including callers who say they are the bank
- Approving a sign-in prompt you did not start
Common mistakes
Saving recovery codes in the same account. If you lose the account you lose the codes.
Approving prompts out of habit. Only approve a sign-in you started.
Keeping one device as the only factor. Register a second device or key.
Do this today
Turn on a second step for your email and your main bank.
Save the recovery codes offline.
Replace any password you have reused.
Once it is set up, a second step adds only a few seconds to each sign-in. That small habit is one of the most effective protections you can add to your accounts.
Questions people ask
What if I lose my phone?
Use the recovery codes you saved, a second registered device or the account's recovery process. This is why you should set up a backup before anything goes wrong.
Are passkeys ready to replace passwords?
They are supported by a growing list of services and phones. Where they exist, they are easier and safer than a password. Keep a password only where a service does not yet offer a passkey.
Sources
Written from these pages and checked against them on October 5, 2026. Programs and rules change, so check the provider’s current terms before you decide.
General information, not financial, legal or travel advice. Your own card terms and the provider’s current rules always come first.