Two-step verification, authenticator apps and passkeys

A password can be guessed, leaked or phished. A second step means a stolen password alone is not enough.

The idea

Signing in can rely on something you know (a password or PIN), something you have (your phone, a key) or something you are (fingerprint, face). Two-step verification, also called two-factor authentication or 2FA, asks for two of these. A fraudster on the other side of the world who has your password still lacks your phone.

The methods compared

Any second step is far better than none. Where you can choose, prefer a passkey or an authenticator app to SMS.

Passkeys in plain words

A passkey replaces the password. When you create one, your phone or computer makes a secret key and keeps it locked behind your fingerprint, face or screen lock; the website stores only a matching public key, which is useless to a thief. To sign in, you unlock your device. Nothing is typed, so there is nothing to phish, guess or leak, and a passkey made for the real site will not work on a look-alike site.

Passkeys saved in Google Password Manager or Apple's iCloud Keychain are copied to your other devices on the same account. Create them wherever you see the option: Google, WhatsApp, Amazon, Microsoft and many banks' and payment apps support them.

Setting up an authenticator app

1. Install a well-known authenticator: Google Authenticator, Microsoft Authenticator or another established one.
2. In the account's security settings choose Authenticator app. A QR code appears.
3. Scan it with the app, then type the six-digit code shown to confirm.
4. Save the backup codes the service offers, on paper, away from the phone.
5. Turn on the app's own backup or sync, or keep the set-up keys, so that a lost phone does not lock you out.

Where to turn it on first

1. Your main email. It resets everything else. See Google account security.
2. WhatsApp (its own six-digit PIN). See WhatsApp settings.
3. Social media. See Instagram and Facebook.
4. Shopping and payment apps that store cards.
5. Cloud storage and anything holding documents or photographs.

Banks and UPI in India already require a second factor for payments: the OTP or the UPI PIN.

The rules that make it work

• A code is typed only by you, into a screen you opened yourself. Read OTP scams.
• Deny prompts you did not cause, and then change the password, because someone has it.
• Keep backup codes and a second method. People are locked out by lost phones far more often than they are hacked.
• Before changing or resetting your phone, move the authenticator to the new one first.
• Update recovery phone and email when they change.

If you lose the phone

Use a backup code or your second method to sign in, remove the lost phone from the account's devices, and set up the authenticator again. Block the SIM with your operator and see lost or stolen phone.