Choose an MFA method you can use and recover safely
Compare passkeys, security keys, authenticator codes and SMS, then secure recovery before depending on the second factor.
In brief
Multifactor authentication adds a check beyond a password. Methods differ: passkeys or suitable security keys can resist phishing, while a typed one-time code can still be stolen by a fake login page.
Start with the email account used to recover other accounts, then protect the services that hold money, personal files or administration access.
Choose for the risk and available support
Use a phishing-resistant option where the service and your devices support it. An authenticator app is a practical alternative for many services, but its code must still only go into a genuine login. Do not buy a security key before checking the services and connectors you need.
Protect against approval fatigue
A surprise push prompt can mean somebody is attempting to sign in. Deny it and inspect the account from its official settings. Repeated requests are not a reason to approve one just to make them stop. A caller asking you to read a code aloud is asking for access, not providing protection.
Test recovery before replacing a phone
Know how the authenticator backs up or transfers accounts and keep service recovery codes secure. Test a spare method if supported. After migration, check that the new device works before wiping the old one, then remove obsolete access deliberately.
Before you act
SMS is usually better than no extra factor when it is the available option, but it has different risks from phishing-resistant methods. No method excuses approving a sign-in you did not initiate.
What to do next
- Open account security directly and inspect the supported authentication methods.
- Enroll an appropriate method and test it without deleting your only existing route.
- Save recovery codes or a supported spare method in a secure independent location.
