Two-Factor Authentication: The Fastest Way to Secure Your Accounts

Microsoft's security team found that enabling two-factor authentication blocks over 99.9% of automated account attacks. It takes about two minutes to set up on most accounts. Despite this, most people still don't use it.

What is two-factor authentication?

Two-factor authentication (2FA) requires two separate verifications when you log in:

• Something you know — your password
• Something you have — a code from your phone, or a physical key

Even if a hacker steals your password, they can't log in without your phone. Most attackers are automated systems that have your password but not your physical device — this is why 2FA is so effective.

The different types of 2FA (best to worst)

1. Authenticator app (best) — Apps like Google Authenticator or Microsoft Authenticator generate a new 6-digit code every 30 seconds. Works without internet or cell signal, and codes can't be intercepted via SIM swap.

2. Push notification — The app sends an approval request. Convenient but requires internet and can be vulnerable to "approval fatigue" attacks.

3. SMS text message (acceptable, not ideal) — A code is sent by text. Better than nothing, but SMS can be intercepted via SIM swap. Still a major security improvement for most people.

4. Hardware key (most secure) — A physical USB device (like a YubiKey). Virtually impossible to hack remotely. Great for businesses or high-security needs.

Which accounts to protect first

How to set up 2FA: step by step

1. Download Google Authenticator or Microsoft Authenticator (free on iOS and Android)
2. Go to the security settings of the account you want to protect (Settings → Security or Privacy)
3. Find "Two-factor authentication," "Two-step verification," or "MFA" and click Enable
4. Choose "Authenticator app" when given the option
5. Scan the QR code shown on screen with your authenticator app
6. Enter the 6-digit code from the app to confirm it works
7. Save your backup codes — these get you back in if you lose your phone. Print them or store them in a password manager.

What if I lose my phone?

The backup codes from step 7 are the answer. Every service that offers 2FA provides one-time backup codes when you set it up. Store them somewhere safe — printed in a drawer, or in a secure location separate from your phone. Many authenticator apps also let you back up accounts to Google or Apple so you can restore them on a new device.

For small businesses

Enforcing 2FA on Microsoft 365 or Google Workspace should be a top priority. Business email compromise — where an attacker takes over an employee's email and intercepts payments — is one of the most financially damaging cybercrimes for small businesses. 2FA stops it almost completely.