Two‑Factor Authentication: How to safeguard your accounts even if your password is stolen

Why a password alone isn’t enough

Passwords constantly end up in data breaches, get harvested in phishing attacks, or are guessed. With two‑factor authentication (2FA), an attacker also needs something you have – usually your phone. Even with your password, they still can’t get into your account.

Methods compared

• **Passkey or security key:** the most secure. Works only on the genuine website, so it’s phishing‑proof.
• **Authenticator app:** very good. The app generates a new 6‑digit code every 30 seconds, even without an internet connection.
• **SMS code:** better than nothing, but vulnerable – e.g., if scammers port your number to a new SIM card.
• **Email code:** only as secure as your mailbox. Secure your email account first.

Set up in 5 minutes

• Open the service’s security or account settings and look for “Two‑Factor”, “2‑Step Verification” or “Passkey”.
• If possible, choose a Passkey or authenticator app and scan the displayed QR code with the app.
• Enter the code from the app once to confirm.
• Save the recovery codes somewhere safe, e.g., printed out or stored in your password manager.

Where to start

• Your email account – it’s used to reset almost every other password.
• Online banking, payment services and stores where you’ve saved a card.
• Social networks and messengers.
• Your account with us: Under “Account” you can create a Passkey and log in securely without a password.

Typical scam using 2FA codes

A caller or a message asks you to “confirm” by providing a freshly received code. Scammers use that exact code to log into your account. Never share such codes – no legitimate support will ever ask for them. If you receive a code you didn’t request, change your password immediately.

And what does a VPN add?

A VPN encrypts your connection so that on public Wi‑Fi nobody can snoop on your logins. Combined with 2FA and a unique password for each service, you’re in good shape. Create a strong password with our password generator, and use the Leak Check to see if your address has already appeared in a data breach.