A second step at login stops most account takeovers, even when a password has been stolen. Here’s how to set it up.
Quick summary
- Multi-factor authentication (MFA) asks for something extra, such as a code or a security key, as well as your password.
- Turn it on first for your email, banking, social media and any account that stores payment details.
- ACSC guidance rates authenticator apps as more secure than codes sent by SMS or email, and physical security keys as stronger still.
- SMS codes are still better than no MFA at all.
- Save your recovery codes somewhere safe in case you lose your phone.
Passwords get stolen through data breaches, fake login pages and malware. Multi-factor authentication (MFA) adds a second check, so a stolen password alone isn’t enough to get into your account. It takes a few minutes to set up and is one of the most effective protections available.
How it works
When you log in, MFA asks for two or more types of proof:
- Something you know, such as a password or passphrase.
- Something you have, such as your phone or a physical security key.
- Something you are, such as a fingerprint or face scan.
Different services call it different things: two-step verification, two-factor authentication or login approval. You’ll usually find it in your account’s security settings.
Which accounts to protect first
- Email: it’s used to reset most other accounts.
- Banking and payment services.
- Social media and messaging, which scammers can use to impersonate you.
- Shopping accounts that store card details.
- Cloud storage holding your photos and documents.
Choosing a method
The Australian Cyber Security Centre’s guidance ranks MFA methods roughly like this:
| Method | How it works | Security |
|---|---|---|
| Physical security key | A small device you plug in or tap | Strongest |
| Authenticator app | An app on your phone generates codes or approves logins | Strong |
| SMS or email code | A code is sent to your phone or inbox | Weakest, but better than none |
Codes sent by SMS or email are less secure because phone numbers can be hijacked and email accounts compromised. If a service offers an authenticator app or security key, choose that.
Be careful
Never read out or forward an MFA code to anyone, even someone claiming to be from your bank, your telco or a tech company. Genuine organisations won’t ask for it. Scammers often call pretending to help, then ask for “the code we just sent.”
Setting it up
- Open the account’s security settings and find MFA or two-step verification.
- Choose the authenticator app option if available. The service shows a QR code for the app to scan.
- Enter the code from the app to confirm.
- Save the recovery codes the service gives you, on paper or in your password manager, not just on the same phone.
Watch for unexpected prompts
If you get a code or login approval request you didn’t ask for, someone may have your password. Deny it, change your passphrase and check your account for unfamiliar devices.
Pair it with good passwords
MFA works best alongside strong, unique passphrases. See our guides to passphrases and password managers.
Your questions answered
Is two-step verification the same as MFA?
Often, yes. Different services use different names, such as two-step verification, two-factor authentication or login approvals. Look in your account’s security settings.
What if I lose my phone?
Use the recovery codes most services give you when you set up MFA, or a backup method you added. That’s why it’s worth saving recovery codes somewhere safe and offline.
Should I approve a login request I didn’t start?
No. An unexpected approval request or code usually means someone has your password. Deny it, change your password and check your account’s security settings.
Can scammers get around MFA?
Sometimes, mostly by tricking people into reading out codes or approving logins. Never share an MFA code with anyone, even someone claiming to be from your bank or a tech company.
This guide is general information, not technical or legal advice. If you’ve lost money or personal information, contact your bank, IDCARE on 1800 595 160, or report it through ReportCyber at cyber.gov.au.