Two-factor authentication means proving who you are twice: something you know, which is the password, and something you have, which is usually your phone. It matters because passwords leak constantly, and a leaked password on its own is useless to somebody who cannot also produce the code. Nearly every account takeover we get called about happened on an account that had no second factor turned on.

The Short Version

Turn it on for your email first, because email is how every other account gets reset. Use an authenticator app rather than text messages where the site offers a choice. Save the backup codes somewhere you will find them again. And before you hand in your old phone, move the codes across, because that is the step everyone forgets and it is the one that causes the lockout.

The Three Kinds, Worst To Best

Why Text Message Codes Are the Weak One

The attack is called SIM swapping. Someone contacts your mobile carrier, impersonates you convincingly enough to get your number moved to a SIM card they control, and from that moment every code the bank texts you arrives on their phone instead. No malware, nothing installed, nothing you would notice until your own phone loses service.

This is worth understanding without being frightened by it. It takes real effort and it is usually aimed at people the attacker already knows are worth the trouble. A texted code still blocks the overwhelmingly common attack, which is somebody trying a password that leaked from another website. So if a site only offers text messages, take the text messages. Just prefer an app when you get the choice, and ask your carrier to add a port-out PIN to your account, which most now offer.

Moving Your Codes To a New Phone

Here is the part that ruins weekends. An authenticator app's codes usually live on the one device unless you tell it otherwise, so factory resetting the old phone before moving them means every account using that app is now locked. Do this while the old phone still works.

There is a simpler answer for a lot of households: keep the codes in your password manager instead. Most of them generate the same six-digit codes, and because the vault already syncs, a new phone stops being an event at all. See our password manager comparison for which ones do this.

Backup Codes: Ten Minutes Nobody Spends

When you switch two-factor on, most sites offer a list of one-time backup codes. They exist for exactly the situation where the phone is lost, broken, or in the Gulf. Almost nobody saves them, which is why a lost phone turns into a week of support tickets and identity checks.

Save them when the site offers them, not later, because most sites will not show you the same list again. Print them and put them with the important papers, or store them in your password manager. Both is better. If you only do this for two accounts, do it for your email and your bank.

What To Turn On First

• Your email. Every other account resets through it, so an attacker with your email has everything else eventually. This one is not optional.
• Your bank and anything holding a card. Most have it available and many people have never looked.
• Your Apple or Google account. It holds your photos, your contacts, your backups, and often your passwords.
• Social media. Less about the account and more about the people who trust messages coming from it.
• Anything work related. Email, remote access, payroll, the accounting system.

If the Phone Is Already Gone

Do not start with the authenticator app. There is an order that matters, and getting it wrong costs time you do not have. Work through lost or stolen phone: the first hour, which covers locking the device, protecting the accounts on it, suspending the line, and when to erase it remotely.

For a Small Office

Two-factor on business email is the single cheapest security control available, and it is the first thing a cyber insurance questionnaire asks about. Two things trip up small offices: shared logins that nobody can enable it on because four people use the account, and staff who set it up on a personal phone that walks out the door when they leave. Both are fixable, and both are better fixed before the renewal form asks. Continuous monitoring of the accounts themselves is the next layer up, covered in identity threats 101.

Quick Self-Check

Frequently Asked Questions

Is two-factor authentication by text message better than nothing?

Yes, clearly. A texted code still stops the most common attack, which is someone logging in with a password they bought or guessed. It is the weakest of the three methods because a phone number can be moved to an attacker's SIM, but weak two-factor beats no two-factor every time. Turn it on now and upgrade to an app later.

How do I move my authenticator codes to a new phone?

Do it before you wipe the old phone. In Google Authenticator, open the menu, choose Transfer codes, then Export codes, pick the accounts, and scan the QR code from the new phone using Transfer codes and then Import codes. Signing into your Google Account in the app also syncs codes to a new device. Other apps have their own export or backup option, so check yours while the old phone still works.

What are backup codes and do I need them?

They are one-time codes a site gives you when you switch two-factor on, and they are the way back in when the phone is gone. Almost nobody saves them, which is why lockouts turn into long phone calls with support. Print them or save them in your password manager the day you set up each account.

Should I keep my two-factor codes in my password manager?

For most households, yes. It syncs across devices, so a new phone is no longer a crisis, and it is far better than having no second factor because the separate app felt like a hassle. Purists point out that it puts both factors in one vault. That is a real tradeoff, and it is the right one for anyone whose alternative is giving up.

Related guides

All guides →

📞 727-579-4335  ·  ✉️ support@baygeeks.com  ·  Privacy Policy  ·  Terms of Service