Most hacked business accounts are broken into with a stolen or guessed password. Two-step verification (also called 2FA or multi-factor authentication) blocks most of these attacks. Even with your password, an attacker can’t get in without the second step, usually a code or approval on your phone.
Quick answer
- Start with your email account, since it can reset every other password.
- Use an authenticator app or passkey instead of SMS when you can.
- Save your backup codes somewhere safe.
- Then turn it on for banking, social media, WhatsApp, your website and accounting tools.
Which method should you use?
| Method | How it works | Security |
|---|---|---|
| Passkey / security key | Approve with your fingerprint, face or a physical key | Strongest |
| Authenticator app | A 6-digit code that changes every 30 seconds (e.g. Google Authenticator, Microsoft Authenticator) | Very good |
| Phone prompt | Tap “Yes, it’s me” on your phone | Good (never approve a prompt you didn’t start) |
| SMS code | A code by text message | Better than nothing |
Google / Gmail / Google Workspace
- Go to myaccount.google.com → Security.
- Under “How you sign in to Google,” choose 2-Step Verification and follow the steps.
- Add an authenticator app or passkey, and save your backup codes.
Workspace admins can require it for all staff in the Admin console (Security → Authentication → 2-step verification).
Microsoft 365 / Outlook
- Personal Microsoft account: account.microsoft.com → Security → turn on two-step verification.
- Business accounts: the admin turns on multi-factor authentication for everyone (for example with “security defaults” in Microsoft Entra). Staff then set up the Microsoft Authenticator app at their next sign-in.
WhatsApp and WhatsApp Business
Settings → Account → Two-step verification → Turn on. Choose a 6-digit PIN and add an email address in case you forget it. This stops someone from registering your number on another phone. See our WhatsApp Business guide.
Facebook and Instagram
Open Accounts Center → Password and security → Two-factor authentication, choose the account, and select an authentication app (recommended) or SMS.
Also protect these
- Online banking and payment apps
- Your website login (WordPress security plugins add 2FA) and hosting account
- Domain registrar, since losing your domain means losing your email and website. See choosing a domain name.
- Accounting, invoicing and payroll apps
- Your password manager
Backup codes: don’t skip this
If you lose your phone, backup codes are your way back in. Download them when you turn on 2FA and:
- Store them in your password manager, or
- Print them and keep them in a locked drawer
Never keep them only on the same phone you use for codes.
For teams
- Make 2FA mandatory for every staff account, especially email.
- Use shared accounts as little as possible. Give each person their own login.
- When someone leaves, remove their access the same day.
- Teach staff never to share a code. Real companies will never ask for it.
Quick summary
- 2FA stops most password-based attacks.
- Start with email, then banking, social media, WhatsApp and your website.
- Prefer passkeys or an authenticator app over SMS.
- Save backup codes safely.