How to Set Up Two-Factor Authentication (The Way I Do It)
The short answer: to set up two-factor authentication, open the account's settings, go to Security (sometimes called Login and Security), and turn on 2-Step Verification or Two-Factor Authentication. Choose an authenticator app if it's offered, save the backup codes somewhere safe, and start with your email account, because it's the key to resetting everything else. It takes about three minutes per account.
I get asked "how do I actually turn this on?" almost every week, so here's the honest walkthrough I'd give you if we were sat at your kitchen table with your phone in hand.
Why I'm Writing This as an Actual Tutorial
I've written before about why I treat two factor authentication as non-negotiable, and I still stand by every word of that one. But knowing you should do something and knowing how to actually do it are two very different things, and I don't think enough people bridge that gap for their clients. This post skips the persuading and gets straight to the clicking. Grab your phone, get comfortable, and let's go through it properly, one account at a time.
Setting Up 2FA on Your Email Account
Your email is the master key to almost everything else you own online, so it's the first account I secure for every client I work with. In Gmail, go to your Google Account, select Security, then look for 2-Step Verification and follow the prompts. It'll ask for your phone number first, then offer you the option to switch to an authenticator app, which I always recommend over text messages since texts can be intercepted. Outlook works almost the same way: Account, Security, Advanced security options, then Two-step verification. The whole thing takes about three minutes and you only have to do it once.
Setting Up 2FA on Your Banking App
Most UK banking apps have this built in already and switch it on automatically the moment you install them, which is one of the few times I'll happily say the bank knows best. If yours doesn't, open the app, head to Settings or Security, and look for anything called two factor, two step, or biometric login. Turn on Face ID or fingerprint login too if it's offered, it's another layer that costs you nothing and takes half a second each time you log in.
Setting Up 2FA on Social Media
Facebook, Instagram, and X all bury this setting in slightly different places, but the route is roughly the same: Settings, then Security and Login (or Privacy and Security), then Two-Factor Authentication. Pick the authenticator app option where you can, it's more reliable than SMS and doesn't rely on you having signal. I switched every one of my own accounts over years ago and honestly forgot it was even switched on until a login attempt from somewhere I'd never been got blocked without me lifting a finger.
Setting Up 2FA on Your Shopping and Payment Accounts
Amazon, PayPal, and eBay all hold enough of your card details and order history to be worth locking down properly, and this is the section people skip because it feels like a shop, not a bank. It really shouldn't be treated differently. In PayPal, go to Settings, then Security, and turn on Two-Factor Authentication, an authenticator app if it's offered, otherwise a text code will do. Amazon hides its version under Login & Security as Two-Step Verification, and eBay calls it much the same thing under Account Security. I've had a client's PayPal targeted twice in the last two years, both times the attacker got the password right and got stopped dead by the second step. That's the whole point of doing this everywhere, not just the accounts that feel obviously important.
Setting Up 2FA on Your Cloud Storage
Google Drive, iCloud, and Dropbox often get overlooked because they don't feel like a login you use every day, but they're quietly holding years of photos, documents, and sometimes scanned copies of passports or bank statements. For a Google Account, head to myaccount.google.com, Security, then 2-Step Verification, and follow the prompts, it'll walk you through adding an authenticator app or a physical key if you have one. Apple users do this through Settings, your name at the top, then Sign-In & Security, where Two-Factor Authentication is usually already on for newer accounts but worth double checking. Dropbox keeps it under Settings, then Security, with the same Two-Step Verification wording as everywhere else. Five minutes in each one, and it closes off one of the quieter ways people lose things they never meant to share.
Setting Up 2FA on WhatsApp
WhatsApp is one of the accounts scammers go after most, usually by messaging you pretending to be a friend and asking you to forward a six-digit code that was "sent to you by mistake". That code is the key to your account. WhatsApp's own version of two-factor is called two-step verification. Open Settings, tap Account, then Two-step verification, and turn it on. It asks you to choose a six-digit PIN and add an email address in case you ever forget it. Once it's on, anyone who gets hold of that text code still can't take over your account without the PIN. And if a friend ever asks you to send them a code, ring them on a number you already have before you do anything.
What to Do If You Lose Your Phone
This is the bit people worry about most, and fair enough. Before you switch anything on, write down or print the backup codes every service gives you during setup and keep them somewhere safe, not in your phone's notes app. I keep mine in NordPass, the password manager I use and recommend to every client, since it works even if my phone ends up at the bottom of a lake. If you do lose your phone, most services let you verify a new device through your email or by answering a security question, so having that email account locked down properly matters more here than anywhere else.
Two-Factor Authentication Set-Up Questions
How long does it take to set up two-factor authentication?
About three to five minutes per account. If you do your email, bank, social media and shopping accounts in one sitting, you're looking at half an hour, and you only ever do it once.
Which authenticator app should I use?
Google Authenticator and Microsoft Authenticator are both free and do the job well, and many password managers can store the codes too. Picking one and actually using it matters far more than which logo is on it.
Do I still need two-factor if I have a strong password?
Yes. A strong password can still be stolen through a data breach or a fake login page. Two-factor means a stolen password on its own isn't enough, which is exactly the situation it's there for. I've explained why two-factor authentication is so important in more detail separately.
What if a website doesn't offer two-factor authentication?
Use a long, unique password for that site that you don't use anywhere else, ideally one generated by a password manager. That way, if the site is ever breached, the damage stops there.
Will two-factor stop me logging in on a new phone?
Not if you've kept your backup codes. Most services also let you confirm a new device through your email, which is why I always tell people to secure their email account first.
If any of this feels fiddly the first time, that's completely normal, and I'd rather you found it fiddly for five minutes than found out the hard way why it matters. The National Cyber Security Centre backs up everything I've said here too, if you fancy the official version alongside mine. For a proper hand held walkthrough of everything on your accounts, my digital safety check-up is a good place to start, and I've put together a full safety toolkit with the password manager and VPN I actually use myself. If you'd rather just ask me directly, get in touch and I'll talk you through it.
I also share printable checklists and quick safety tips as pins, so follow me on Pinterest too.