A second factor is the single highest-value change you can make: it turns a stolen password from a breach into a dead end.
Most account takeovers use a password that was already known — leaked from another site, guessed, or reused. A second factor is the one control that makes a known password insufficient on its own.
The differences between the types matter less than switching any of them on. Start with email, then banking, then anything holding your money or your identity.
The three kinds, weakest to strongest
- SMS codes. Widely supported, and they stop the vast majority of automated attacks. Weak against number transfer and interception.
- Authenticator apps. A code generated on your device, tied to that account. Strong against remote attacks, and works offline.
- Hardware keys and passkeys. Nothing to type and nothing to phish, because the credential never leaves the device. The strongest option where supported.
Where to turn it on, in order
- 1Your email account, because every other reset link arrives there.
- 2Banking and any payment app, and then your card issuer's own login.
- 3Password manager, which is the key to everything else.
- 4Cloud storage and photo accounts, which usually hold identity documents and recovery material.
- 5Social and messaging accounts, which are how your contacts are targeted next.
Before you lose the device
- Save the backup codes at the moment you enable it. Most providers show them exactly once.
- Register a second factor if the provider allows it — a second key, or a backup app on another device.
- Check the recovery options: if the alternative route is your phone number and you lose the number, you lose the account.
- Never approve a push notification you did not trigger. Repeated prompts mean someone has your password and is waiting for you to tap yes.
Frequently asked questions
Someone keeps sending me login approval prompts. What does that mean?
It means they have your password and are waiting for you to approve. Change the password immediately and deny every prompt. Do not approve one 'to make it stop'.
I lost the phone with my authenticator app. Am I locked out?
That is what the backup codes are for. Without them, recovery depends on the provider and can take days. Save them when you set the factor up, not later.
Is a passkey better than a password with an app code?
For the accounts that support it, yes: a passkey cannot be typed into a fake page, so it removes the phishing risk entirely. Keep the app code as a fallback.
Written by The BaitScan team
Last updated September 16, 2026
Results are automated risk estimates based on public indicators and heuristics.