How to Turn On 2-Step Verification

Turning on 2-step verification is the single most useful thing most households can do for their online accounts, and it takes a few minutes. It adds a second step when you log in, so a criminal who knows your password still cannot get in¹. The National Cyber Security Centre (NCSC) calls it the first and most important step to protect you if your password gets phished or otherwise compromised².

You do not need to do everything at once. Start with the accounts that would cause the most trouble if someone else got into them: your email, then banking, then social media. The NCSC says to set it up on important accounts like email and banking even if they already have a strong password, and that it only takes a few minutes³. It also says to set it up on all your important accounts, email and social media included, even if you have a strong password⁴.

The switch is almost always in the account's own security settings, not on the login screen. Once it is on, most services send a PIN or code, often by SMS or email, which you enter to prove it is really you³. If an account has already been hacked, 2SV is still part of the fix, but it comes after you have regained control.

What 2-step verification does, and why a strong password is not enough

A password is a single lock. If someone learns it, by phishing, by a leak from another company, or by guessing, they are in. Two-step verification adds an extra security step when you log into online services, to double-check that it really is you¹. The NCSC's own summary is that it gives you twice the protection by adding a second step when you log on, so even if cyber criminals have your password they cannot access your account⁶.

In practice it usually works by sending you a PIN or code, often by SMS or email, which you enter to prove it is really you³. Some services use an app instead, and the NCSC describes the code as coming from an app or SMS⁴. Either way, the point is the same: the criminal has the password but not the second step.

This matters most for email. Your email account is the reset route for almost everything else, so the NCSC advises setting up 2SV on your email account, which will prevent a criminal from accessing it even if they know your password⁷. The same advice applies to a password manager: switch on 2SV on the password manager account, so a criminal who knows the primary password still cannot access it². And it applies to cloud backups, because anyone who can access your cloud account also has access to your backups⁸.

Where to find the 2SV switch

The option to switch on 2SV is usually in the security settings of your account¹. The NCSC repeats the point: if 2SV is available for an account, the option to switch it on is usually found in the security settings for the account⁶. So the route is the same everywhere, even when the menu names differ:

1. Sign in to the account on the service's own website or app, not through a link in an email.
2. Open the account, profile or settings area.
3. Look for security, then for two-step verification, two-factor authentication or 2FA. The names mean the same thing³.
4. Choose how you want the second step to arrive, usually a code by SMS or email, or an app.
5. Finish the set-up and keep the recovery codes or backup method the service offers somewhere safe offline.

The NCSC publishes a guide to setting it up on popular services at ncsc.gov.uk/2sv, and suggests looking in the security settings included in antivirus or password manager tools⁴. If you are not sure which accounts matter most, our checklist on which accounts to protect with 2-step verification sets them out in order.

If your password has been phished or leaked

A password that has been phished or leaked should be treated as gone. The NCSC's advice for exactly this situation is to turn on 2-step verification first, because it protects you if your password gets phished or otherwise compromised². Then change the password, and use a strong and different one for each account.

The NCSC's guidance on scam "missed parcel" text messages makes the same point in a different setting: set up two-step verification wherever possible, particularly on your most important accounts⁹. Its malware advice says that whilst updating your passwords, you should set up 2SV on accounts, where possible¹⁰. The pattern is consistent: 2SV goes on alongside the new password, not instead of it.

If you are not sure whether a password has leaked, our guide on how to check if your email was in a breach walks through it. If you have already clicked a link, clicked a phishing link: what to do next covers the immediate steps, and phishing: how to spot a scam email, text or call explains what to look for next time.

Setting up 2SV after an account has been hacked

If an account has already been taken over, 2SV is part of the recovery, not a substitute for it. The NCSC's recovery guidance lists setting up 2-step verification as step 5, after you have dealt with the account itself⁵. Its infographic describes 2SV, also known as two-factor authentication or 2FA, as usually working by sending a PIN or code, often via SMS or email, to prove it is really you⁵.

The order matters because 2SV set up while a criminal still has access simply locks you out alongside them. Work through the recovery steps first, then add 2SV once you are back in control. The NCSC's recovery guidance makes setting up 2-step verification its fifth step³. For email specifically, how to recover a hacked email account covers the account-level steps, and how to check for forwarding rules set by hackers explains one of the tricks to look for before you consider the account clean.

Once the account is back, set up 2SV, then check the other accounts that use the same password. The NCSC's recovery guidance makes setting up 2-step verification its fifth step¹¹.

Accounts without a 2SV option, and smart home devices

Not every account offers 2SV yet. For accounts that do not yet offer passkeys, the NCSC advises continuing to use a strong and unique password and two-step verification². In other words, use 2SV wherever it exists, and where it does not, make the password strong and different from every other account. A password manager helps with that, and the NCSC advises switching on 2SV on the password manager account itself². Our page on whether you need a password manager explains what one does.

Smart home devices are accounts too. The NCSC's guidance on smart device security law says that if the device or app offers two-step verification, you should turn it on¹². A smart speaker, camera or baby monitor is usually controlled through an app, and that app account is the way in, so protecting it with 2SV keeps someone who learns the password out of your home devices. Our guide to smart speakers, cameras and baby monitors covers the rest of the settings worth checking.

If you do not have a mobile phone, or would rather not use SMS, you are not stuck: many services offer a code by email or an authenticator app instead. Our page on whether you can set up 2-step verification without a mobile sets out the options.

The official NCSC guidance, and where to get help

The NCSC recommends turning on 2-step verification to help protect your online accounts¹³. Its Cyber Aware campaign repeats the same line¹⁴, and its top tips say to turn on 2SV for your most important accounts⁶. The NCSC says you can find out how to set it up on popular services at ncsc.gov.uk/2sv, or look in the security settings included in antivirus or password manager tools⁴.

The wider official picture is consistent. Sussex Resilience Forum's household emergency advice says to turn on 2-Factor Authentication on all online accounts, use a strong and different password for each account, keep antivirus and software updated, and back up files automatically¹⁵. Essex Preparedness says to enable two-factor authentication in your security to double check that you are who you say you are when you log in¹³. Wiltshire and Swindon Preparedness says to set up 2SV on your email account, which will prevent a criminal from accessing it even if they know your password¹⁶.

If a device has been infected rather than an account hacked, the NCSC advises that after fixing the infection you follow its advice for setting up your devices securely and keeping them safe, and check your device is encrypted¹⁷. For PCs and laptops, it says to make sure you have antivirus and install security updates as soon as they are available, ideally by setting them to install automatically¹⁸. Our page on the National Cyber Security Centre: help for individuals and families explains what else the NCSC offers, and the home online security checklist puts 2SV alongside the other settings worth doing. For the wider picture, start with cyber attacks and major IT failures: a household guide.