Two-step sign-in

A password is something you know. Two-step sign-in adds a second proof: something you have, like your phone or a small key, or something you are, like a fingerprint. Someone who steals your password still cannot get in without the second piece.

You will also see it called multi-factor authentication (MFA) or two-factor authentication (2FA). They mean the same thing here.

CISA's guidance is direct: phishing-resistant MFA is the standard to aim for, but any MFA is better than no MFA.

The kinds, strongest first

• Passkeys and security keys. A passkey lives on your phone or computer; a security key is a small device you plug in or tap. Both use a standard called FIDO. CISA calls FIDO the only widely available phishing-resistant authentication, because it checks the real website's address and refuses to work on a fake one.
• An authenticator app with number matching. The sign-in screen shows a number and you type it into the app. Matching makes it much harder to trick you into approving someone else's attempt.
• An authenticator app code or a push prompt. Good, and far better than a password alone.
• A text message code. The weakest kind, because texts can be intercepted or a phone number moved to another SIM card. Still worth it when nothing else is offered.

Use the strongest kind each account offers.

How the second step still gets stolen

Codes can be phished. A fake sign-in page asks for your password, then asks for the code, and passes both to the real site within seconds. That is why passkeys are better: they will not work on the fake page.

The other trick is a phone call. Someone says they are from IT, the bank or a vendor and asks you to read back "the code we just sent." No legitimate caller needs that code. Hang up and report it.

Remember: No legitimate caller needs your sign-in code. Hang up and report it.

The third trick is a flood of approval prompts, sent until a tired person taps "Approve." If your phone asks you to approve a sign-in you did not start, someone already has your password. Deny it, change the password, and tell your IT contact.

Where to turn it on first

1. Your email. It resets everything else.
2. Your password manager.
3. Anything that moves money: banking, payroll, the finance system, vendor payment portals.
4. Your website's admin login and your institution's social media accounts.
5. The domain registrar, where your web address is registered. Losing it takes down your website and email at once.

Plan for a lost phone

Before you need it, set up a way back in. Most services offer backup codes: print them and store them with your other sensitive originals. Many let you register a second passkey or security key. Keep the spare somewhere safe, away from the first.

If your institution manages accounts centrally, find out who resets two-step sign-in when a phone is lost, and how they confirm it is really you.