Two-Factor Authentication: Why It Matters and How to Turn It On

What two-factor authentication is

Two-factor authentication (2FA) confirms a sign-in using two different kinds of proof: something you know (a password) and something you have or something you are (a code from an app, a physical key, a fingerprint). If one factor is compromised — say your password turns up in yet another database leak — the second factor still stands guard over the account.

Why a password alone isn't enough

Passwords get stolen through phishing, guessed from leaked-database dictionaries, and reused across services — if the password on one site matches your email password, breaking into one account drags the rest down with it. Even a strong, unique password generated by a password manager doesn't protect you from typing it into a fake login page. That's why current digital identity guidance (NIST SP 800-63B) states plainly that a password on its own isn't phishing-resistant, and important accounts need an additional factor — ideally one that's hard to intercept remotely.

What kinds of 2FA exist

• SMS code — the simplest option, but vulnerable to SIM-swap interception and carrier social engineering.
• Authenticator app (TOTP) — generates a one-time code every 30 seconds from a shared secret, with no network connection required (Google Authenticator, Aegis, Microsoft Authenticator and similar apps). Works even if the phone is offline.
• Push confirmation — the service sends an "Is this you signing in?" prompt to a device you've already linked.
• Hardware key or passkey — the most phishing-resistant option: the key verifies you're actually on the service's real site, not a lookalike.

How much this actually helps

According to research from Google and Microsoft, turning on any second factor — even a basic one — blocks the overwhelming majority of automated credential-stuffing and mass phishing attempts: a bot simply has nothing to answer a code prompt with. The effect is somewhat more modest against targeted attacks, but an authenticator app or hardware key is still more reliable than SMS alone.

How to turn on 2FA: step by step

1. Open the account's security settings (usually a "Security" or "Login and Recovery" section) in your email, messenger, or banking app.
2. Pick a verification method. If you have a choice, prefer an authenticator app or a passkey over SMS.
3. Scan the QR code with your authenticator app, or confirm the device link.
4. Save the backup recovery codes somewhere safe — not in your phone's notes app, which can vanish along with the codes.
5. Sign in from another device or browser to confirm the second factor is actually being requested.

Since the codes are now effectively tied to your phone, it's worth checking the device's overall security too — our separate Android security checklist covers that.

Checklist after enabling 2FA

• Recovery codes are saved offline (paper or a password manager) — not only in a screenshot folder.
• At least one backup sign-in method is set up in case the phone is lost.
• The account password is still unique and strong — 2FA complements a password, it doesn't replace it; we covered choosing a password tool in our article on password managers.
• Review the list of active sessions and connected devices in the service's settings every few months.

If you have to receive a code or push prompt over public Wi-Fi — at a cafe, hotel, or airport — it's worth encrypting that leg of the connection separately: more on that in our article on protecting data on public networks. HamikVPN is one practical tool for that kind of encryption on both phone and computer — the Android app is available on the download page.