Turn on two-step verification for your email

It goes by several names: two-step verification, two-factor authentication (2FA) and multi-factor authentication (MFA). They all mean the same thing: your password, plus something you have.

Steps

1. Choose your second step. The FTC lists three common kinds. A code sent by text message or email is the simplest, and better than nothing. An authenticator app on your phone is safer, because the code can't be intercepted by someone who takes over your phone number. A security key, a small device you plug in, is the strongest.
2. Google (Gmail) accounts. Open your Google Account, select Security & sign-in, and under “How you sign in to Google” select Turn on 2-Step Verification. Follow the steps on the screen.
3. Microsoft (Outlook.com, Hotmail) accounts. Sign in at account.microsoft.com/security, select Manage how I sign in, and under Additional security and Two-step verification choose Turn on. Follow the instructions.
4. Other email providers. Go to your account settings and look for two-factor authentication, two-step verification or multi-factor authentication.
5. Add a backup method. Microsoft recommends keeping three pieces of security information on your account, such as a phone number and two email addresses. If you lose your only method, it can take 30 days to get back in.
6. Sign in once to test it, on a device you own. You can let your own computer be remembered so you aren't asked every time. Don't do that on a shared or public computer.

The one rule that keeps it working

Never give a verification code to someone else. The FTC's rule: don't share a code with anyone you didn't contact first. Google says the same in its own words: you won't receive a call from Google to verify a code. A caller who asks for the code that just arrived on your phone is trying to get into your account.

If that didn't work

• An older mail program says “incorrect password” afterwards. With a Microsoft account, some apps and devices can't use security codes and need a special “app password” instead; Microsoft's page explains how to create one.
• You don't get the text message. Check the phone number on the account, or switch to an authenticator app, which works without mobile service.
• A work or school account. These are managed by your organization, and the steps may not work. Ask your administrator.

What next

Do your bank, card and payment accounts next, then shopping sites. And make sure the password behind all this is a good one: see strong passwords and password managers.