How to set up multi-factor authentication (MFA)
MFA adds a second step to sign-in so a stolen password alone is not enough.
Multi-factor authentication (MFA), also called two-step verification, asks for something in addition to your password. Even if a password is stolen, the attacker is usually stopped.
Which accounts first
- Email (Microsoft 365, Google Workspace, Outlook.com, Gmail)
- Banking and payment accounts
- Your domain registrar and website hosting
- Your password manager
- Social media and any admin consoles
Choosing a method (strongest to weakest)
- Passkeys or security keys: phishing resistant and the best option where supported
- Authenticator app: a code or push approval from an app on your phone
- Text message codes: better than nothing, but vulnerable to SIM swapping
General setup steps
- Sign in to the account and open the security or sign-in settings.
- Find "Two-step verification", "2FA" or "MFA" and choose authenticator app or passkey.
- Scan the QR code with your authenticator app and enter the code it shows.
- Save the backup or recovery codes in your password manager or another safe place.
- Add a second method if offered, so losing your phone does not lock you out.
Important
- Never approve an MFA prompt you did not start. Unexpected prompts can mean someone has your password. Deny it and change the password.
- Nobody legitimate will ask you to read an MFA code to them over the phone.
Last updated Oct 31, 2026, 2:49 PM ET