Skip to content

Two-Factor Authentication: What It Is and How to Turn It On

Key takeaways

  • Two-factor authentication (2FA) asks for a second proof of identity on top of your password, so a stolen password alone isn’t enough to get into your account.
  • It goes by other names too: multifactor authentication (MFA), two-step authentication or 2-step verification.
  • Turning it on takes three steps in your account’s security settings, according to CISA.
  • Not all methods are equally strong, but CISA says any MFA is better than none.

This article is general information based on US government guidance. Settings and menu names differ between apps.

What it is

The US cybersecurity agency CISA explains that multifactor authentication (MFA) means proving who you are with two or more things before an account lets you in. When you enable it on an online service such as email, you must provide a combination of two or more “authenticators.” They fall into three groups:

  • Something you know, like a password or PIN.
  • Something you have, like an authenticator app or a confirmation text on your phone.
  • Something you are, like a fingerprint or face scan.

CISA lists these names for the same idea: multifactor authentication, two-step authentication, 2-step verification, two-factor authentication and 2FA.

Why it matters

CISA says passwords can be “reused, more easily cracked, or stolen.” With MFA turned on, even if a criminal gets your password, they “will be unable to meet the second authentication requirement,” which stops them getting into the account. CISA says users who enable MFA are significantly less likely to be hacked.

The FTC makes the same point in its phishing advice: multi-factor authentication makes it harder for scammers to log in to your accounts if they do get your username and password. For help spotting the scams that steal passwords, see our guide on how to spot a phishing email.

CISA’s example describes someone whose email was taken over. Because his other accounts were linked to it, the attacker was able to reach his social media, bank and retail accounts. CISA says using MFA on the email account could have stopped the chain of events. That’s why email is a good place to start.

How to turn it on: three steps

CISA’s steps for each account or app:

  1. Go to Settings. Look under your account profile. It may be called Account Settings, Profile, Preferences, Privacy or similar. Then open the security settings, which may be labelled Security or Password and Security.
  2. Find and turn on MFA. It may be called two-factor authentication, two-step authentication or similar.
  3. Choose your method and confirm. Pick from the options your account offers.

Afterward, your account may ask for the second step when you log in. CISA says it only takes a moment.

Which method should you choose?

CISA lists these popular forms:

  • Text message (SMS) or voice message, such as a numeric code sent by text or email.
  • An authenticator app, a phone app that generates a new code every 30 seconds.
  • Biometrics, meaning a fingerprint or face scan.
  • Phishing-resistant MFA.

CISA says “not all MFA methods give you the same level of protection,” but that “any MFA is better than no MFA.” It describes phishing-resistant MFA as the standard to aim for, and says the only widely available phishing-resistant method is FIDO/WebAuthn authentication, which blocks a login attempt when a criminal tricks you into using a fake website. If you can’t use phishing-resistant MFA, CISA suggests number matching in MFA apps to block push-notification and SMS-based attacks. CISA has a graphic ranking the types from strongest to weakest. We haven’t summarised it here.

In practice, that means: if your account offers a stronger option, such as a security key or a passkey, consider it. If it only offers text codes, turn those on anyway.

Where to turn it on first

CISA suggests enabling MFA wherever it’s offered, particularly on:

  • email accounts,
  • financial services,
  • social media accounts,
  • online stores,
  • gaming and streaming services.

If an account doesn’t offer MFA, CISA suggests asking the company why not.

Frequently asked questions

Is two-factor authentication the same as multifactor authentication? They’re closely related. CISA lists two-factor authentication as one of several names for the same idea.

Is a text message code enough? CISA says any MFA is better than none, but that text messages are not the strongest option.

Will it slow me down? It adds a short step at login, which CISA says takes only a moment.

Does MFA stop all hacking? No. It makes account takeover much harder, but you should still use strong passwords, update your software and watch for phishing.

Information checked on: October 30, 2026. Guidance changes, so check CISA’s current pages.

Sources

  • CISA, Turn On MFA (cisa.gov, labelled “Archived Content” on the page)
  • CISA, More than a Password (cisa.gov, labelled “Archived Content” on the page)
  • FTC, How To Recognize and Avoid Phishing Scams (consumer.ftc.gov, dated September 2022 on the page)

Related stories