Two-Factor Authentication: The 10-Minute Setup That Protects Everything

Two-factor authentication (2FA) is the cheapest and most effective security you can add: besides your password, it requires a temporary code that changes every few seconds. Even if someone steals your password, they cannot get in without it.

Authenticator app beats SMS

When you get the choice, use an authenticator app rather than SMS codes. The reason is SIM swapping: if an attacker convinces your mobile carrier to transfer your number to their device, every SMS code goes to them. An authenticator app lives on your phone and does not depend on the phone line at all.

Where to start, in this order

1. Your email — it is the master key, since every other account resets through it
2. Your wallets and anything holding money
3. Your gaming accounts, especially ones with purchases
4. Your social media

The step almost everyone skips

When you enable 2FA, each service shows you backup codes. Save them somewhere safe — written down or in a password manager. They are your only way back in if you lose your phone, and most people close that screen without reading it.

Common mistakes

• Enabling 2FA and not saving the backup codes.
• Using the same email and password everywhere.
• Sharing a verification code with someone "helping" you — outside an account-based top-up you ordered yourself, no legitimate support ever asks for one.
• Setting up 2FA only on the game account but leaving the email unprotected.

Worth knowing

If a service offers only SMS 2FA, still turn it on. SMS is weaker than an app, but it is far stronger than nothing.

Step by step on the accounts that matter

• Google: myaccount.google.com > Security > 2-Step Verification. Choose the authenticator app or Google prompts over SMS. Google Authenticator now syncs your codes to your Google Account (version 6 and later), so a lost phone no longer means lost codes; you can also export them manually with a QR code.
• Apple: two-factor is built into the Apple Account. Check Settings > your name > Sign-In & Security and keep at least one trusted phone number you control.
• Riot: enable Multi-Factor Authentication via the Riot Mobile app or your verified email. Riot also stresses that the only real login page is authenticate.riotgames.com.
• Epic: Account > Password & Security > enable the authenticator app and SMS. Epic may use both to verify a recovery request.
• Supercell ID: Account Protection > Recovery Codes or SMS verification.
• Roblox: Settings > Security > authenticator app, plus an Account PIN.
• Binance and other wallets: use the authenticator app, not SMS, since this is where real money sits. If you use Binance, turn on its authenticator-app 2FA before you move money there.

Passkeys: what changed and whether you should switch

A passkey signs you in with your fingerprint, face or screen lock and is tied to the real website, so it cannot be phished or reused on a fake page. Google offers a "passkey-first" sign-in; the password stays as a fallback, and if you keep 2-Step Verification on, the passkey can serve as the second factor. Requirements: Android 9+, iOS 16+, a device screen lock, and iCloud Keychain on Apple devices. Create one at myaccount.google.com/signinoptions/passkeys and repeat on each device you use. Practical advice: turn on passkeys for the email first; keep the authenticator app for services that do not support them yet.

Moving to a new phone without locking yourself out

1. Before wiping the old phone, open the authenticator app and confirm the codes are synced (Google Authenticator) or export them with the transfer QR.
2. Keep the old phone until you have logged into every important account from the new one at least once.
3. If any service uses SMS, make sure the number moves with you before you travel or change carriers.
4. Update trusted phone numbers in Apple and Google, and the recovery phone in Riot, Epic and Supercell.
5. Store the backup codes somewhere that is not the phone: a password manager or a printed sheet.

For the rest of the migration (photos, chats, games), Move photos, chats and games before wiping the old phone.

Which authenticator app?

• Google Authenticator: simple, and since 2023 it backs up codes to your Google Account.
• Microsoft Authenticator: also stores codes with a cloud backup and handles Microsoft sign-ins.
• Authy, Proton Authenticator, 2FAS, Aegis: valid alternatives; pick one with encrypted backup and stick to it.
• Avoid unknown "2FA" apps with a handful of downloads: some are built to harvest the secrets you scan.

Common failure modes and the fix

• Codes are rejected everywhere: the phone clock drifted. Set date and time to network time; Google Authenticator 7 removed its own time correction and relies on the system clock.
• Lost phone, no backup codes: use each service's account recovery form. It takes days and proof of ownership, which is why the backup step matters.
• SMS never arrives: carrier delays or a number no longer active. Switch that account to an app code as soon as you regain access.
• Someone "from support" contacts you and asks for the code: that is the attack. The only time a code is requested is during an account-based top-up you ordered, through the order channel.