Two Factor Authentication Guide: Passwords & 2FA Setup

Two-factor authentication (2FA) is a second check after your password — usually a code from an app or a tap on your phone — that stops a stranger from logging in even if they know your password. The short version of this two factor authentication guide: use a long unique password for every account, turn on app-based 2FA (not text messages) wherever you can, and start with your email. Do those three things and you block the most common account takeovers.

We're the editors at Getshure. We publish plain-English books on AI scams and data privacy, and we sell protection plans that include the Getshure app. This guide is the free walk-through. If you want a tool that also checks whether your email and passwords are already in a known breach, we'll point you to that at the end.

Why passwords alone are not enough

Billions of usernames and passwords have leaked from old data breaches over the years. Criminals buy those lists and try the same email-and-password combos on banks, email providers, Amazon, PayPal, Netflix, and more. If you reuse a password anywhere, one old breach can unlock your whole life.

Two-factor authentication solves this by asking for a second thing when someone tries to log in from a new device:

• Something you know — your password.
• Something you have — your phone, an authenticator app, or a security key.

Even if a scammer has your password, they can't finish the login without that second factor.

Step 1: Build strong, unique passwords

A strong password is long and not reused. Length matters more than symbols. Here's what we recommend.

The basic rules

1. At least 14 characters. Longer is harder to crack.
2. Unique per account. Never reuse your email password anywhere else.
3. No personal info. Skip birthdays, pet names, kids' names, street addresses.
4. Use a passphrase if you'll have to remember it. Four random words like copper-violin-harbor-pickle are strong and typeable.

Use a password manager

You can't remember 80 unique long passwords. A password manager does it for you. Options include the built-in managers on iPhone (Passwords app) and Android/Chrome (Google Password Manager), or a dedicated app. They generate random passwords, fill them in automatically, and sync across your devices.

Your master password — the one that unlocks the manager — is the one password you must memorize. Make it long, write it on paper, and store that paper somewhere safe at home.

Prioritize these accounts

Don't try to fix everything in one night. Start with the accounts that unlock everything else:

1. Your primary email (Gmail, Outlook, iCloud, Yahoo).
2. Your phone carrier account (AT&T, Verizon, T-Mobile).
3. Your bank and credit card logins.
4. Amazon, PayPal, Venmo, Cash App.
5. Social media (Facebook, Instagram, X, LinkedIn).
6. Government accounts (IRS, Social Security, state DMV).

Step 2: Understand the three kinds of 2FA

Not all two-factor is equal. Here's how they rank, from weakest to strongest.

SMS text codes (okay, but weakest)

The site texts you a 6-digit code. This is better than nothing, and it's what most people start with. The weakness: if a scammer convinces your carrier to move your number to their SIM card (a "SIM swap"), they get your codes. Still, if that's all an account offers, turn it on.

Authenticator apps (recommended)

An app on your phone — Google Authenticator, Microsoft Authenticator, Authy, or the built-in iPhone Passwords codes — generates a new 6-digit code every 30 seconds. Nothing is sent over the phone network, so SIM swaps don't help the attacker. This is the sweet spot for most people.

Security keys (strongest)

A small USB or wireless key (like a YubiKey) that you tap to log in. Phishing-resistant and great for high-value accounts, but overkill for most users. Worth considering for your main email and bank if you've been targeted before.

Step 3: Turn on 2FA, account by account

The menu name varies, but the setting is usually under Security, Sign-in & security, or Login. Here's the pattern:

1. Log in to the account on a computer.
2. Open Settings, then Security or Login.
3. Find Two-factor authentication or 2-step verification.
4. Choose Authenticator app if offered. Scan the QR code with your authenticator app.
5. Enter the 6-digit code to confirm.
6. Save your backup codes. Print them or write them down. These let you in if you lose your phone.

Start with email

Your email is the master key. Anyone who controls it can reset the password on every other account. Turn on 2FA here first, before anything else.

Then banking and money apps

Many banks still only offer SMS. Turn it on anyway. Also set up login alerts so you get a message any time someone signs in.

Then social media

Facebook, Instagram, and X all support authenticator-app 2FA. Takeovers here lead to romance scams and cryptocurrency pitches aimed at your friends and family.

Step 4: Handle backup codes the right way

Backup codes are one-time codes that work when your phone is lost, broken, or stolen. If you skip this step, losing your phone can lock you out of your own accounts for days.

• Print them and keep them in a drawer or safe at home.
• Don't email them to yourself — that defeats the purpose.
• Don't screenshot them to your cloud photos unless that cloud is also protected by 2FA.
• Regenerate them after you've used some, so you always have a full set.

Step 5: Protect your phone number from SIM swaps

Because text codes still protect some accounts, you want to make it hard for someone to steal your phone number. Call your carrier and ask them to:

1. Add a port-out PIN or account PIN to your line.
2. Require that PIN before any SIM change or number transfer.
3. Note that no changes should be made without in-person ID at a store.

This takes five minutes and shuts down one of the most damaging attacks going.

Check if your passwords are already leaked: the Getshure app breach check

Here's the uncomfortable truth: even a strong new password doesn't help the accounts where you still have an old, reused one. You need to know which of your emails and passwords are already circulating in known breaches so you can change those first.

The Getshure app includes a breach check feature as part of every protection plan. You enter your email, and the app tells you if it appears in known data breaches — and which ones — so you know exactly which accounts to prioritize. It also flags passwords that have shown up in leaks. Combined with the app's Scam Shield (spam-call ID and robocall blocking), encrypted vault for photos and files, and data broker removal requests, it turns "I should get around to this" into a checklist you can actually finish.

Plans start at $9.99, $29.99, or $79.99 today and then renew at $29.99 every 30 days until you cancel. You can cancel in one step at getshure.com/cancel, and there's a 30-day money-back guarantee on every charge — no reason needed. You can read more about the app at The Getshure App: What It Does and What It Can't Do, or get the Android version directly on Google Play. iPhone users: the download link is in your order confirmation email after you buy a plan.

No app blocks every scam or leak — but a breach check tells you where to point your effort, which is more than most people ever get.

The hardcover for the whole picture: "Don't Get Screwed by AI"

Passwords and 2FA are one chapter of a bigger story. AI tools now help scammers write better phishing emails, clone voices, and build fake login pages that look identical to the real thing. Our hardcover Don't Get Screwed by AI ($29, free US shipping on orders of $40+) walks through all of it in plain English — the scams, the red flags, and the exact steps to lock things down. It's written for an adult who is tired of jargon and just wants to know what to do.

If you want a single book to hand to a parent, a spouse, or an adult child who you worry about, this is the one we'd give them.

Common mistakes to avoid

• Using the same "base" password with a number on the end. Scammers try those variations first.
• Linking a recovery email that you don't check. Old Yahoo accounts with weak passwords are a common back door.
• Letting the browser save passwords without a device passcode. Anyone who picks up your laptop can see them.
• Skipping 2FA on "small" accounts. A hacked loyalty account often shares a password with your bank.
• Approving a login push you didn't start. If your phone pings you to approve a login, and you weren't logging in, deny it and change your password.

A 30-minute weekend checklist

1. Install a password manager and set a long master password.
2. Change your primary email password to something long and unique.
3. Turn on authenticator-app 2FA for your email. Save backup codes on paper.
4. Do the same for your bank, Amazon, PayPal, and main social media.
5. Call your phone carrier and add a port-out PIN.
6. Run a breach check on your email to find accounts you need to fix first.

You don't need to be perfect. You need to be a harder target than the person next to you — and this list gets you there.

Next steps with Getshure

If you want help getting this done instead of doing it all alone:

• Order the book: Don't Get Screwed by AI — plain-English hardcover, $29.
• Get the app's breach check and Scam Shield: see plans and download instructions at Getshure App Sign In.
• Prefer to talk to a human? Call us at (754) 812-1679, Monday–Friday, 9 AM–6 PM Eastern, or email contact@getshure.com.

We're a US company — MetaWise Enterprises, LLC, registered in Delaware, based in Coral Springs, Florida. Every plan has a 30-day money-back guarantee and one-step cancel. You can verify all of that before you spend a dollar on the About and refund policy pages.

Related reading: How to Check if Your Email or Password Was Leaked, Your Data Was in a Breach: What to Do Next, and Fake Bank Text Message: How to Spot and Stop It.