Turn on two-factor — use an app, not a text

Two-factor authentication (2FA) means that even if a criminal steals your password, it isn't enough on its own — they also need a second code from your phone. It is the single best thing you can do to protect an account.

The codes from an authenticator app (like Google Authenticator or Microsoft Authenticator) are safer than codes sent by text message. Text codes can be stolen if a criminal tricks your phone company into moving your number to their SIM card. Use a text code only if an app isn't offered.

What to do: turn on two-factor authentication everywhere it's offered — email first. Where you can, choose the authenticator-app option rather than SMS text codes.