Set up two-step verification on your key accounts

One extra step blocks most account takeovers. Even if a password leaks, a second factor keeps an attacker out of your email, bank, and social accounts.

Start with your email

Your email account can reset the password for almost everything else, so protect it first. Open the security settings and turn on two-step verification.

Then do the same for banking, cloud storage, social media, and any shopping account that stores a card.

Choose the right second factor

An authenticator app or a physical security key is stronger than a text message, because codes sent by SMS can be intercepted or redirected. Passkeys, where available, are better still.

Text messages are still far better than no second factor at all if they are the only option.

Save your recovery codes

When you enable two-step verification, most services offer a set of one-time recovery codes. Store them in your password manager or print them and keep them somewhere safe.

Those codes are what get you back in if you lose your phone.