Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To enable multi-factor authentication (MFA), open an account’s official Account, Profile, Privacy, or Security settings, choose Multi-Factor Authentication, Two-Factor Authentication, or Two-Step Verification, select a method, and complete the verification prompt. Menu names vary, but the process is similar on email, social-media, banking, payment, and credit-card accounts.
Protect your primary email first because it is often the recovery channel for every other account. Then secure banking and payment accounts, credit cards, social media, and tax-filing services. A FIDO2/WebAuthn security key is the strongest broadly available option against phishing; an authenticator app is the best general-purpose choice when a key is not supported. Text-message or email codes are useful fallback methods, but they provide weaker protection.
What MFA does and why you should enable it first on email
Multi-factor authentication requires two or more different types of proof before an account grants access. The first factor is usually something you know, such as a password. The second can be something you have, such as a phone, authenticator app, or physical security key, or something you are, such as a fingerprint or face scan. If someone steals your password, MFA can still block the login because the attacker lacks the second factor.
Free tools Windows power users keep installed
One-click scans. No signup required.
Two-factor authentication (2FA) is a specific form of MFA that uses exactly two factors. Providers use the terms inconsistently, so treat MFA, 2FA, and two-step verification as the setting you need to find.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Start with the account that can reset your other passwords. The Federal Trade Commission recommends prioritizing your bank, credit cards, email, social media, tax-filing website, and payment apps. Email belongs at the top because a person who controls it may be able to request password resets elsewhere.
Choose the strongest method the account supports
Enable the best available method, then add a recovery method that will still work if your primary device is lost. No method eliminates phishing, malicious apps, or unsafe account recovery, so the enrollment and recovery details matter as much as the choice of factor.
| Method | When to use it | Security and practical notes |
|---|---|---|
| FIDO2/WebAuthn security key | Use as your primary method when the provider supports it; register a spare key if permitted. | CISA describes FIDO/WebAuthn as the only widely available phishing-resistant authentication. A physical key resists fake sign-in pages because the key verifies the legitimate site. |
| Authenticator app with number matching | Strong everyday choice when a security key is unavailable. | The app displays a number during sign-in and you approve only the prompt you initiated. Reject unexpected prompts. |
| Authenticator-app one-time code | Use when push approval or a security key is not available. | The app generates a new code approximately every 30 seconds. Enter the current code during sign-in. |
| Passkey or biometric | Use on a trusted phone, computer, or hardware platform that supports it. | Biometrics unlock a device-held credential; keep another recovery method in case the device is lost or reset. |
| SMS or email code | Use only when stronger options are unavailable, or as a carefully protected fallback. | CISA ranks text and email codes as the weakest listed options because phishing and phone-number takeover can expose them. |
Authenticator apps are generally safer than SMS or email codes, but they are not automatically safe: a scammer can still trick you into entering a code on a fake site or approving an unexpected prompt. A security key provides the strongest phishing resistance described by CISA.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Prepare before turning MFA on
- Start from the provider’s address that you type yourself or from its official app. Do not follow an unsolicited email or text link to enroll.
- Have your current password and a trusted device available.
- Install an authenticator app from your device’s official app store if you plan to use one.
- If you choose a security key, keep the key with you during enrollment and plan where a spare will be stored.
- Prepare a secure offline location for single-use recovery codes. Do not leave the only copy in the account you are protecting.
- Check that your recovery email address and phone number are current, and understand that a recovery address is not a substitute for MFA on that address.
Enable MFA on your email account
Secure email before other services that send password-reset links or verification codes by email. The exact labels differ between webmail and mobile apps, but the path normally starts in the account avatar or menu and then goes to Account, Profile, or Security.
Google Gmail
- Open Gmail or the Google Account page from a typed address or the official app.
- Open your account’s Security section and select 2-Step Verification or the equivalent MFA control.
- Follow the enrollment prompt. Prefer a passkey, security key, or authenticator app when offered; use SMS only if stronger choices are unavailable.
- Complete the test sign-in and record the single-use backup codes in your offline secure location.
- Review signed-in devices, recovery phone numbers, and recovery email addresses. Sign out devices you do not recognize and remove obsolete recovery details.
Google may ask for an existing sign-in check before allowing changes. That check is separate from the new MFA method; complete both steps and confirm that a fresh private-browser sign-in requests the second factor.
Microsoft Outlook and Microsoft accounts
- Open Outlook or your Microsoft account through the official app or a typed address.
- Go to Security and look for Advanced security options, Two-step verification, or Manage how I sign in. Work and school accounts may use different labels controlled by an administrator.
- Add an authenticator app, passkey, or security key first when available. If the account uses number matching, approve only a number you requested.
- Save recovery codes and add a second recovery method that does not depend on the same phone.
- Inspect recent activity and signed-in devices, then revoke sessions you cannot identify.
For any other email provider, search its account settings for Security, Login, Privacy, or Two-step verification. If the provider sends a code to an email address, protect that mailbox with its own MFA before relying on it as a recovery channel.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Enable two-factor authentication on social media
Social platforms generally place the control under Security, Login, or an account center. Facebook and Instagram commonly group sign-in controls under an Accounts Center; labels can vary by app version and region.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Open Facebook directly and enter Settings & privacy, then Settings.
- Open the Accounts Center if it is shown, choose Password and security, and select Two-factor authentication.
- Choose the account, select an authenticator app or security key when offered, and complete the challenge. Use SMS only when stronger methods are not available.
- Save recovery codes, review where you are logged in, and end sessions you do not recognize.
- Open your profile, the menu, and Settings and privacy.
- Open the Accounts Center, choose Password and security, and select Two-factor authentication.
- Enroll an authenticator app or security key, complete the test prompt, and store the recovery codes offline.
- Review login activity and remove unfamiliar devices. Change your password if an unknown session appears.
- Open your profile menu and choose Settings & Privacy.
- Open Sign in & security and select Two-step verification.
- Choose an authenticator app when available, or another supported method, and finish the verification prompt.
- Review active sessions and trusted devices, save the recovery information, and remove access you no longer need.
CISA’s social-media guidance identifies Facebook, Twitter, and LinkedIn as services that support authenticator-app MFA through account settings. Regardless of platform, an app or security key is preferable to SMS when the option exists.
Enable MFA on banking, credit-card, and payment accounts
Use the bank’s official mobile app or type the institution’s web address yourself. Never enroll through a link in an unsolicited message, even if it appears to use the bank’s logo.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Sign in and open Security, Login, Profile, Privacy, or a similarly named settings area.
- Choose Multi-factor authentication, Two-factor authentication, Two-step verification, or Login verification.
- Select the strongest method the institution supports. A security key, passkey, or authenticator app is preferable to a text message.
- Complete the enrollment challenge and perform a fresh sign-in test if the bank provides one.
- Save single-use recovery codes or follow the bank’s documented recovery process. Keep a recovery method that does not depend on the same phone you use for approval.
- Turn on alerts for new devices, password changes, beneficiary changes, transfers, and other high-risk actions when the institution offers them.
- Review recent sign-ins and trusted devices. Contact the bank through the number on your card or its official website if you see an unfamiliar session or transaction.
Banks sometimes restrict which MFA methods are available or require a phone number for specific transactions. Use the strongest choice offered, and do not disable MFA merely because the institution also requires SMS for one operation.
Save recovery access without weakening the account
Recovery is part of MFA, not an afterthought. A lost phone, erased authenticator app, damaged security key, or changed number can otherwise lock you out.
Recommended Free Tools
- Store single-use codes offline. Print them or place them in a secure password manager vault that is protected independently of the account. Treat each code like a password; cross out or delete a code after use.
- Register a second factor. If allowed, enroll a spare security key or a second trusted device. Keep the spare somewhere separate from your everyday device.
- Use independent recovery channels. Do not make the only backup a phone that can be lost, stolen, or disconnected. A recovery email must itself be secured.
- Update changes immediately. When you replace a phone, change a number, or retire an email address, add the new method before removing the old one.
- Understand provider-specific limits. Some services let you regenerate codes; others require identity checks or customer support. Read the recovery screen before you need it.
Test the setup and clean up existing access
Enrollment is complete only when you know the second factor works and old access has been removed.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
- Open a private browser window or sign out on a separate device.
- Sign in with your password and confirm that the service requests the new factor.
- Approve only the prompt or enter only the code generated for that test.
- Test one recovery code if the provider allows it, then mark that code as used and secure the remaining codes.
- Check the account’s signed-in devices, active sessions, connected apps, and trusted browsers.
- Revoke anything unfamiliar or obsolete, then change the password if you suspect unauthorized access.
Fix common MFA problems
The security setting is missing
Use the provider’s website rather than a limited mobile-app view, and search under Account, Profile, Privacy, Security, Login, or an Accounts Center. Work and school accounts may hide options that an administrator controls. If the service truly offers no stronger method, enable SMS or email verification temporarily and ask support whether an authenticator app, passkey, or security key is available.
The authenticator code is rejected
Make sure the device clock is set automatically, use the newest code before it expires, and confirm that you selected the correct account entry in the app. Do not repeatedly guess codes; too many attempts can trigger a lockout. If the phone was restored or the app was reinstalled, use a recovery code or the provider’s documented account-recovery process rather than deleting more entries.
You receive an unexpected approval request
Reject it. Do not approve a prompt simply to make the alerts stop. Change the account password from the official site, review active sessions and recovery details, and contact the provider if the requests continue. Repeated prompts can indicate that someone already knows the password.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteYour phone or security key is lost
Use a registered spare factor or a single-use recovery code from a trusted device. After regaining access, remove the lost device or key from the account, change the password if it may have been exposed, and enroll a replacement. For a bank, use the official support number if self-service recovery is unavailable.
You changed your phone number
Add and verify the new number or a stronger method before removing the old number. Update every account separately; changing the number with your mobile carrier does not update MFA settings held by websites.
Keep MFA effective over time
- Review security activity and signed-in devices after travel, a device replacement, or a suspected phishing attempt.
- Install operating-system and browser updates so passkeys, biometric checks, and authenticator apps receive security fixes.
- Never disclose a one-time code to a caller, chat agent, or message sender. Legitimate support should not ask you to read an approval code to them.
- Check the domain and app before entering a password or code. MFA cannot protect you if you hand both factors to a convincing fake sign-in page.
- Use a unique password for every account. MFA reduces the damage from a stolen password, but password reuse still exposes multiple accounts at once.
- Revisit recovery methods periodically and remove old phone numbers, email addresses, devices, and third-party apps.
MFA is most effective when it is enabled on the accounts that can unlock your finances and identity, uses a phishing-resistant key or app whenever possible, and has recovery options you can reach without relying on one lost device.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
