To take action : 10–20 min per account · Depending on your devices and accounts
A password, even a good one, isn't enough
Add sign-in protection and prepare account recovery.
PatchYourself · Last editorial revision : · Sources
Fictional example: an everyday situation
A fake page captures Sam’s password. A second step can stop some sign-ins, but a fake site can also ask for his code. Sam learns how methods differ and sets up a passkey where his provider supports it.
The problem
A password can be stolen even when it is strong. Two-factor authentication, or 2FA, asks for another proof. It reduces risk, but different methods do not provide equal protection.
A factor can be something you know (a password), possess (a key or phone) or are (a biometric characteristic). A fingerprint can unlock a passkey on a device; it is not a code sent to the website.
Which method should you choose?
| Method | What to understand |
|---|---|
| Passkey or FIDO security key | Bound to the expected website, providing phishing-resistant sign-in. Check recovery options. |
| Authenticator app | Generates codes without relying on SMS. A fake site can still ask for a code and relay it. |
| SMS | Useful if it is the only option, but exposed to threats including phone-number takeover. |
An app asking you to approve a notification is not automatically phishing-resistant. Reject sign-in requests you did not initiate and open your account settings yourself.
What to do now
Step 1: Open official settings
Start with your email. Use the provider’s app or address, not a link in a message. Look for “Security”, “Sign-in”, “Passkeys” or “Two-step verification”. Names vary by version and account type.
Step 2: Set up an available method
If passkeys are supported, create one on a personal device protected by a screen lock. Someone who can unlock that device may be able to use its passkeys, so avoid shared devices.
Otherwise, install an authenticator app from its official store. Scan the setup code and confirm a test code. Keep your existing session open while setting this up. If only SMS is offered, enable it.
Step 3: Prepare recovery
Check recovery contact details. Keep backup codes offline somewhere safe, or in a vault accessible independently of the account they protect. Some providers use a different process: read it before losing access to your device.
A synced passkey also depends on the protection and recovery of the account that syncs it. Keep an appropriate backup method. Do not remove old access methods before confirming the new ones.
Step 4: Continue with important accounts
Protect your other accounts next. Your bank may require its own method: use the one it provides. Never give a code or approval to someone claiming to be an adviser.
Go further
Why passkeys resist phishing
Passkeys use a cryptographic key pair and verify the service you are signing into. They will not sign in for an unrelated domain in the way a code copied onto a fake page can be relayed. This does not make a compromised device, abused recovery process or stolen session harmless.
Phone-number takeover
A SIM swap transfers control of a number to an attacker, who may then receive the victim’s SMS messages. Protect your mobile-provider account and contact the provider if your service unexpectedly stops working.
Sources and verification
References used for this revision. Menus and offers can change; consult the provider’s help for your version.