Should I turn on two-factor authentication?
Yes, on every account that matters, starting with email, then banking, your domain registrar, website admin, Google account and social media. With two-factor authentication, a stolen password alone isn't enough to get in. Passkeys and security keys are strongest, authenticator apps come next, and text codes are better than nothing.
The short version
- Turn it on everywhere that matters, email first.
- Prefer passkeys or security keys, then authenticator apps, then text codes.
- Deny any sign-in prompt you didn’t start.
- Save your backup codes somewhere safe.
- Require it for the whole team, not only the owner.
What is two-factor authentication?
Two-factor authentication (also called 2FA, two-step verification or MFA) adds a second check when you sign in. After your password, you confirm with something you have, usually your phone or a small security key. Our glossary has a short definition of two-factor authentication.
The US Cybersecurity and Infrastructure Security Agency says in its MFA guidance that any MFA is better than none.
Which accounts should I protect first?
Start with the accounts that unlock everything else:
- Email. It can reset almost every other password.
- Banking and payment accounts.
- Domain registrar. Whoever controls your domain controls your website and email. See who should own your domain.
- Website administrator logins. See WordPress user roles.
- The Google account behind your Business Profile, Search Console and Analytics.
- Social media and your password manager.
Which method should I choose?
| Method | Strength | Notes |
|---|---|---|
| Passkeys and security keys | Strongest | Phishing-resistant: they only work on the real site |
| Authenticator app | Strong | A code or a prompt on your phone |
| Text message code | Better than nothing | Can be phished or lost to a SIM-swap scam |
CISA calls phishing-resistant MFA, such as FIDO passkeys and security keys, the standard to aim for. NIST’s digital identity guidelines treat phone-network codes as a restricted option. Use the strongest method each service offers that your team will actually use.
Why does it matter?
Passwords leak in data breaches, get reused across sites and get typed into fake login pages. A second factor means a leaked password isn’t enough on its own. That’s why phishing emails now often try to steal the code too. See how to spot a phishing email.
What are the common mistakes?
- Approving a prompt you didn’t start. Attackers with your password sometimes send prompt after prompt, hoping you’ll tap approve. CISA recommends number matching to block this.
- Losing the backup codes. A lost phone can then lock you out for days.
- Owner only. One unprotected staff mailbox can still be taken over.
- Typing a code into a page reached from an email link. Go to the site directly instead.
What if I’m locked out?
Use a backup code, or the service’s account recovery. For a business email account, your email administrator can usually reset your second factor after confirming who you are. Never send passwords or codes to anyone by email or text.
How much time does it take?
Setting it up takes a few minutes per account. In Microsoft 365, an administrator can require it for everyone with security defaults. Google Workspace has a similar admin setting.
How does E-3 handle this?
If you think an account has been taken over, call 814-399-4655 or read what to do if someone is sending email as you.
Related questions
Common questions
- What if I lose my phone?
- Use the backup codes each service gives you when you turn it on. Store them somewhere safe, like your password manager. Some authenticator apps can also move to a new phone.
- Is a text message code good enough?
- It's much better than nothing. Passkeys, security keys and authenticator apps are stronger, because text codes can be phished or stolen through phone-number scams.
- What if I get a sign-in prompt I didn't ask for?
- Deny it, then change that account's password. An unexpected prompt usually means someone already has your password.
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.