Two-factor authentication blocks the majority of account takeover attacks — a unique password plus a second verification factor means a breached password alone cannot grant access. Yet many users who have 2FA on some accounts have never thought through the edge cases: what happens when the authenticator app is unavailable? How do you migrate to a new phone without losing access? What attacks bypass 2FA even when it’s correctly set up? If you want the full context, see our Complete Guide to Online Security and Privacy.
This guide focuses on the full two-factor authentication lifecycle — from choosing the right method through enrollment, backup, migration, and edge cases — rather than just the step-by-step for a single platform.
Choosing the right 2FA method — before installing anything
The 2FA method choice determines the protection level. Available methods have meaningfully different security properties:
Authenticator app (TOTP): the recommended default for most accounts. Time-based One-Time Passwords are generated on the device without any network connection — immune to SIM swap attacks and functional offline. Supported by virtually every service offering 2FA. The limitation: TOTP codes can be intercepted in real time by adversary-in-the-middle phishing attacks that capture the code during a live session. For most consumer accounts, this is an acceptable limitation. Apps: Google Authenticator, Authy, Aegis (Android), Raivo OTP (iOS).
Hardware security key (FIDO2/WebAuthn): the strongest available second factor. A physical key (YubiKey, Google Titan Key) that cryptographically signs login challenges. Unlike TOTP, hardware keys are phishing-resistant — they verify the website’s exact domain before signing, refusing to authenticate on fake sites. For email, financial accounts, and anything where compromise would be catastrophic, enrolling a hardware key is the right choice. Maintain two keys enrolled on each critical account — a primary and a backup stored separately.
Passkeys: cryptographically domain-bound, phishing-resistant, and more convenient than either TOTP or hardware keys. Where supported, use passkeys as the first choice over 2FA. Our guide on passkeys vs passwords covers this in detail.
SMS 2FA: the weakest option — vulnerable to SIM swap attacks where an attacker convinces the mobile carrier to transfer your phone number to their SIM. Upgrade SMS to an authenticator app on any high-value account (email, banking). That said: SMS is still meaningfully better than no 2FA, because it defeats automated credential stuffing even if it’s vulnerable to the more targeted SIM swap attack.
Methods compared
| Method | Phishing resistant? | SIM swap resistant? | Works offline? | Priority |
| Hardware key (FIDO2) | Yes — verifies domain before signing | Yes | Yes | Highest value accounts (email, financial) |
| Passkey | Yes — domain bound | Yes | Device dependent | Use first wherever supported |
| Authenticator app (TOTP) | No — code can be captured real-time | Yes | Yes | Default for all other accounts |
| Push notification (Duo, MS Authenticator) | Partial (number matching reduces risk) | Yes | No — needs internet | Corporate environments |
| SMS OTP | No | No — SIM swap vulnerable | No | Fallback only; avoid for high-value accounts |
The common mistakes that break 2FA
Not saving backup codes: every service generates one-time backup codes when 2FA is first enabled. Users who skip this step create a situation where a lost phone locks them out of their own accounts permanently. Save backup codes to the password manager’s secure notes at the moment they appear — before closing the screen. Thirty seconds now prevents potentially hours of account recovery effort later.
Only one device or method: a 2FA setup that relies on a single authenticator app on a single phone has a single point of failure. Enroll a backup method — a second authenticator app on a tablet, a hardware key, or backup codes. For critical accounts, enrolling both an authenticator app and a hardware key provides redundancy that survives any single-device failure.
Sharing codes on request: real-time vishing attacks — attacker calls claiming to be your bank’s security team, asks you to “verify” by reading the code you just received — capture the TOTP code and use it immediately to complete their own login. No legitimate organisation ever needs you to read out a 2FA code. If an inbound caller asks for a 2FA code: hang up. This technique specifically targets the most human-exploitable weakness in any 2FA setup.
Enabling SMS as the only high-value account factor without upgrading to an authenticator app — leaving it as the sole method rather than a fallback.
The step-by-step setup for a new account
- Navigate to security settings. Look for “Two-factor authentication,” “2-Step Verification,” or “Multi-factor authentication.” The label varies by service.
- Choose the strongest available method. Hardware key if listed → authenticator app → SMS as a last resort.
- For authenticator app: scan the QR code. Open the authenticator app → Add account → Scan QR code → enter the 6-digit code shown in the app to confirm. The code changes every 30 seconds — enter it promptly.
- Save the backup codes immediately. Copy them to the password manager’s secure notes for this account. For email and financial accounts: also print a copy and store it physically in a secure location. This is the most important step — backup codes are generated once and must be saved at that moment.
- Test the setup before closing. Log out → log back in with the password → when prompted for the second factor, use the authenticator code → confirm successful login. Testing immediately confirms the setup worked before you’re in a situation that requires it.
- For hardware keys: enroll a backup key. Navigate back to security settings while still logged in → add a security key → enroll the backup key → store it at a different physical location from the primary.
- Note the full recovery pathway. After enabling 2FA, note what recovery options remain: backup codes (saved in step 4), recovery phone or email (confirm these are secured). Understanding the recovery path before needing it prevents the panic that leads to disabling 2FA.
Step 4 is the safety net for everything else. Every other step can be re-done if something goes wrong; backup codes are generated once. A user who completed every other step but skipped step 4 has a 2FA configuration with no known recovery path if the authenticator device is lost.
Migrating to a new phone — the most common 2FA crisis
Phone replacement is the most common scenario that exposes gaps in a 2FA setup. Users who set up 2FA, used it daily for years, and never thought about migration discover when replacing their phone that their authenticator app codes didn’t transfer automatically.
Apps with cloud backup (Google Authenticator, Authy): sign into the same account on the new device and restore the backup. Google Authenticator requires the same Google account; Authy requires the backup password set during initial setup. Verify the backup is active before wiping the old device — check the app’s settings for backup status and last backup time.
Apps with local-only storage (Aegis on Android): app’s Export function → export an encrypted backup → transfer the file to the new device → import into Aegis. The export is password-protected; the password must be known to complete import on the new device.
After any phone migration: test the 2FA setup on every critical account — attempt login and confirm the second factor prompt is satisfied by the new device — before wiping the old device or deactivating its SIM.
Our guide on online account security covers the account security maintenance that includes periodic 2FA review as part of regular security hygiene. For CISA’s multi-factor authentication guidance identifying backup code storage as the most commonly missed step in consumer 2FA deployment, CISA’s MFA guidance covers the deployment recommendations in detail.
Shared accounts — the 2FA distribution challenge
Shared accounts (streaming services, household utilities, shared business tools) create a practical challenge: a single second factor protecting an account that multiple people log into from different devices. One household member holds the 2FA and everyone else can’t log in independently when that person is unavailable.
Solutions for shared account 2FA:
- Authy’s multi-device feature: the same TOTP account accessible on multiple enrolled devices simultaneously
- TOTP seed in a shared password manager: 1Password Families or Bitwarden Organisation allows all authorised users access to the same TOTP seed, generating codes independently on each person’s device
- Backup codes as the shared method: stored in a shared secure note, accessible to all household members who need account access when the primary 2FA holder is unavailable
Team and business 2FA considerations
Organisations implementing 2FA across a team need to address questions that individual setup doesn’t raise: who holds backup codes for shared service accounts (the cloud hosting billing account, the domain registrar admin account)? What happens to 2FA configuration for team accounts when an employee with access leaves? How does the IT team securely distribute new TOTP seeds when service accounts need re-enrollment?
Best practice: designate named owners for shared account 2FA, store backup codes in the team password manager’s secure notes with clearly labelled access, and include 2FA configuration explicitly in onboarding and offboarding checklists. Our guide on password manager for teams covers the team credential management framework that 2FA plugs into for organisational deployments.
Per-service 2FA setup paths — the major platforms
Settings locations vary enough between services to cause confusion. Quick reference for the most common:
- Google account: myaccount.google.com → Security → 2-Step Verification → choose authenticator app or security key
- Apple ID: appleid.apple.com → Sign-In and Security → Two-Factor Authentication (Note: Apple uses its own device-based 2FA system, not TOTP; hardware keys are supported at Settings → Password & Security → Security Keys)
- Microsoft account: account.microsoft.com → Security → Advanced security options → Two-step verification
- GitHub: Settings → Password and authentication → Two-factor authentication → choose preferred method
- Twitter/X: Settings → Security and account access → Security → Two-factor authentication
- Facebook/Instagram: Settings → Security and Login → Two-Factor Authentication
- Dropbox: account.dropbox.com → Security → Two-step verification
- Banking accounts: vary significantly by institution; look for Security or Account Protection in account settings; call the bank if not visible in the app
What 2FA does and doesn’t protect against
Two-factor authentication is not a silver bullet. Understanding the boundaries helps set accurate expectations:
What 2FA protects: automated credential stuffing (most common attack); password spray attacks; database breach reuse; attackers who obtain your password through any means but don’t have physical access to your second factor. You might also run into Secure Home Office Setup.
What 2FA doesn’t fully protect (method-dependent): AitM phishing that captures both password and TOTP code in real time (defeated by passkeys and hardware keys, not TOTP); SIM swap attacks against SMS 2FA; malware on the device that intercepts TOTP codes; social engineering where you’re tricked into sharing the code; account recovery flows with weak verification. Related: Hardware Security Key.
The layered security model is: strong unique password (prevents credential stuffing before 2FA is even needed) + TOTP or better 2FA (addresses everything the password doesn’t) + passkey or hardware key where available (closes the AitM phishing gap that TOTP leaves open) + backup codes saved and tested (ensures 2FA doesn’t lock you out of your own accounts). Each layer addresses what the others miss. Two-factor authentication is one layer in that stack — an important one, but not the only one. If this sounds familiar, Two-Factor Authentication is worth a look.
