What is two-step verification?

Two-step verification, also called 2FA (Two-Factor Authentication), is an extra layer of security for your online accounts. Instead of using only a password, you need a second piece of proof to show that you really are the owner of the account. This makes it much harder for hackers to access your personal data, even if they have figured out your password.

Think of two-step verification as a double lock on your front door. The first lock is your password, the second lock is a code you receive on your phone or generate with a special app. Only with both keys can you open the door.

Why is two-step verification so important?

In today's digital world, passwords are regularly stolen or hacked. Cybercriminals use various methods to get hold of your login details, such as phishing attacks, data breaches at companies, or simply guessing weak passwords.

The benefits of 2FA at a glance

  • Better protection: Even if someone knows your password, that person can't sign in without the second verification step.
  • Early warning: If you unexpectedly receive a verification code, you know someone is trying to sign in to your account.
  • Peace of mind: You have less to worry about when it comes to the security of your online accounts.
  • Protection of sensitive data: Your banking details, medical information and personal photos stay safe.

Different types of two-step verification

There are several ways to use two-step verification. Each method has its own pros and cons.

SMS verification

This is the best-known form of 2FA. You receive a one-time code in a text message on your phone. You enter this code after your password. The advantage is that anyone with a mobile phone can use it. The disadvantage is that text messages can be intercepted, which makes this not the most secure option.

Authenticator apps

Apps such as Google Authenticator, Microsoft Authenticator or Authy generate a new code on your phone every 30 seconds. This method is more secure than SMS because the codes are created only on your device and are not sent over the network. You do need a smartphone to use these apps.

Hardware keys

A physical security key, such as a YubiKey, is a small device you plug into your computer's USB port or connect to your phone via NFC. This is the most secure form of 2FA, but also the most expensive option.

Biometric verification

Some services use your fingerprint or facial recognition as the second factor. This only works on devices with the right sensors, such as modern smartphones and laptops.

Turning on two-step verification step by step

Turning on 2FA differs per service, but the general steps are similar. Below we explain how it usually works.

Step 1: Go to the security settings

Sign in to your account and look for the settings. You will usually find a section called "Security", "Privacy" or "Account". Within this section, look for "Two-step verification" or "Two-Factor Authentication".

Step 2: Choose your verification method

Select the method you want to use. We recommend an authenticator app for the best balance between security and ease of use. SMS is also a good option if you don't have a smartphone.

With SMS verification, you enter your phone number and receive a test code to confirm that it works. With an authenticator app, you usually scan a QR code with the app, after which the app immediately starts generating codes.

Step 4: Store your recovery codes

Most services give you a set of recovery codes. These are one-time codes you can use if you don't have access to your phone. Keep these codes in a safe place, for example printed out in a safe or in a password manager.

Step 5: Test the verification

Sign out and sign in again to check that everything works. You should now be asked for a verification code after entering your password.

Important accounts to secure with 2FA

Not all accounts are equally important to secure, but some definitely deserve extra attention.

Email accounts

Your email is the key to almost all your other accounts. With access to your email, hackers can reset passwords for other services. So always secure your email account first.

Banking and financial services

Your bank account, credit card and payment services such as PayPal or iDEAL contain sensitive financial information. Most banks already require 2FA, but check this for all the financial services you use.

Social media

Facebook, Instagram, LinkedIn and other social networks contain a lot of personal information. Hackers can use these accounts to steal your identity or scam your contacts.

Cloud storage

Services such as Google Drive, iCloud or Dropbox often contain personal documents and photos. Secure these accounts well to prevent your files from falling into the wrong hands.

Tips for using two-step verification safely

To get the most out of 2FA, there are a few important points to keep in mind.

Back up your authenticator app

If your phone breaks or is stolen, you can lose access to your accounts. Some apps, such as Authy, offer a backup feature. You can also save the QR codes or take screenshots (but store them securely).

Keep your recovery codes safe

Don't store your recovery codes in the same place as your passwords. Print them out and keep them in a safe physical location, or store them in an encrypted password manager.

Update your phone number

If you get a new phone number, don't forget to change it with every service where you use SMS verification. Otherwise you may be locked out of your own accounts.

Watch out for phishing

Even with 2FA you need to watch out for phishing attacks. Never enter a verification code on a website you reached through a suspicious link. Always check that you are on the real website.

Frequently asked questions

What should I do if I lose my phone?

Use the recovery codes you received during setup to sign in. As soon as you have access again, you can set up 2FA again with your new phone. Don't have any recovery codes? Then contact the customer service of the service in question. You may have to prove your identity to regain access.

Is two-step verification mandatory?

For most services 2FA is optional, but some banks and government agencies have made it mandatory. We recommend always turning it on where possible, even if it isn't mandatory.

Can I use the same authenticator app for multiple accounts?

Yes, you can use one authenticator app for all your accounts. The app keeps a separate code for each service you add. This makes managing 2FA for multiple accounts a lot easier.

What if I don't have a smartphone?

Then you can choose SMS verification with a regular mobile phone. Some services also let you receive codes by email or use a hardware key. There are also authenticator programs available for computers.

Looking for an email address? See our offer.