Two-factor authentication (2FA) protects an account by requiring a second proof of identity in addition to your password, such as a code from an app, a passkey or a physical security key. Even if a criminal steals your password, they cannot sign in without that second factor. Turning it on for your email, bank and social accounts is one of the most effective security steps you can take.
Quick answer: enable 2FA on your email first, then on banking, cloud storage and social media. Prefer an authenticator app, a passkey or a security key over SMS codes when available, and save your backup codes somewhere safe.
How 2FA works
Authentication factors fall into three families: something you know (a password or PIN), something you have (a phone, a security key) and something you are (a fingerprint or face). Two-factor authentication combines two different families. Multi-factor authentication (MFA) is the broader term for two or more factors.
The main methods compared
| Method | How it works | Security level | Watch out for |
|---|---|---|---|
| SMS or voice code | A code sent to your phone number | Better than nothing | SIM-swap fraud and phishing of codes |
| Email code | A code sent to your inbox | Depends on your email security | Useless if your email is compromised |
| Authenticator app | A time-based code generated on your phone | Good | Back up or transfer when changing phones |
| Push notification | Approve a sign-in in an app | Good | “Push fatigue” attacks: never approve a request you did not start |
| Passkey | A cryptographic key stored on your device, unlocked with biometrics or PIN | Very good, phishing-resistant | Not yet supported everywhere |
| Hardware security key | A physical USB or NFC key | Very good, phishing-resistant | Buy two and register both |
Which accounts to protect first
- Email: it is the key to resetting every other password.
- Banking and payment apps.
- Password manager, if you use one.
- Cloud storage and photos.
- Social media and messaging.
- Online shopping accounts with saved cards.
- Government accounts such as CRA My Account and provincial portals.
How to turn it on
The wording varies, but the steps are similar for most services:
- Open the account’s security or privacy settings.
- Look for “two-step verification,” “two-factor authentication,” “login verification” or “passkeys.”
- Choose your method; scan the QR code with an authenticator app if you choose that option.
- Enter the code to confirm.
- Download or write down the backup (recovery) codes.
- Add a second method if offered, such as a second security key.
Avoid getting locked out
- Store backup codes offline, for example printed in a safe place, or in a trusted password manager.
- Before changing phones, transfer your authenticator app accounts or make sure each service has another recovery method.
- Keep your recovery email and phone number up to date.
- If you use security keys, register at least two.
2FA and phishing
Criminals now try to steal both your password and your 2FA code at the same time, using fake login pages or calls pretending to be your bank. Legitimate organizations will not ask you to read a verification code to them. Learn the red flags in our guide on how to recognize phishing emails and texts. Phishing-resistant methods like passkeys and security keys are the strongest defence because they only work on the real website.
The Government of Canada’s Get Cyber Safe program also publishes plain-language advice on securing accounts and devices.
Security checklist
- ☐ 2FA on email.
- ☐ 2FA on banking and payment apps.
- ☐ 2FA on password manager and cloud storage.
- ☐ Authenticator app, passkey or security key preferred over SMS.
- ☐ Backup codes saved offline.
- ☐ Recovery phone and email up to date.
- ☐ Unique passwords for each important account.
For small business owners, the same principles apply to every team account; see our list of online tools for small business owners and secure each one.
FAQ
Is SMS 2FA still worth using?
Yes, it is much better than a password alone. But if a service offers an app, passkey or security key, those are stronger.
What if I lose my phone?
Use your backup codes or another registered method to sign in, then remove the lost phone from your accounts and set up 2FA on the new device.
Are passkeys replacing passwords?
Many major services now support passkeys, which can replace passwords entirely on supported accounts. Adoption is growing but not universal.
Conclusion
Two-factor authentication blocks the vast majority of account takeovers that rely on stolen passwords. Start with your email, move to banking and cloud accounts, prefer phishing-resistant methods, and keep your backup codes safe.