Passwords leak. They get reused, guessed, phished or stolen in data breaches that you never hear about. Two-step verification, often called 2FA, adds a second check so that a stolen password alone is not enough to get into your account. It takes a few minutes to set up and it blocks most account takeovers. This guide explains the options in plain language and shows where to switch them on.
What two-step verification actually does
With 2FA on, logging in needs two things: something you know, such as your password, and something you have, such as your phone. When you or anyone else signs in from a new device, the service asks for a short code or a tap on a trusted device. A criminal who has your password but not your phone is stopped at that second step.
The three common types, from weakest to strongest
- SMS codes: a six-digit code sent by text message. Better than nothing, but vulnerable to SIM swap fraud, where someone convinces your operator to move your number to their SIM.
- Authenticator apps: apps such as Google Authenticator or Microsoft Authenticator generate a new code every 30 seconds on your phone, without needing the mobile network. Much harder to intercept.
- Security keys and passkeys: a physical key or a passkey stored on your device. The strongest option for important accounts like email.
Where to switch it on first
Start with the accounts that can reset everything else. Your main email account comes first, because password reset links for almost every other service are sent there. Next comes your phone’s own account (Google or Apple), then social media such as Facebook and WhatsApp, and then any account that holds money or personal data.
Step-by-step: a typical setup
- Open the account’s security settings and find “2-Step Verification” or “Two-factor authentication”.
- Choose authenticator app if it is offered. Scan the QR code with the app.
- Type in the code the app shows to confirm it works.
- Save the backup codes the service gives you. Write them on paper and keep them somewhere safe at home.
- Sign out and sign back in once to make sure the second step works.
WhatsApp has its own version
WhatsApp uses a six-digit PIN called two-step verification. You find it under Settings, Account, Two-step verification. Once set, anyone who tries to register your number on a new phone also needs this PIN. Add an email address there too, so you can reset the PIN if you forget it. This single setting prevents a very common hijack where a scammer tricks you into reading out a registration code.
Never share codes, whoever asks
A verification code is meant for you alone. Banks, wallet providers, platforms and genuine agents do not need it. Anyone who asks for a code, even politely and even with a believable reason, is trying to get into your account. The same caution applies to people who contact you claiming to represent a service. Before trusting a contact, use a published reference such as a Bangladesh agent list for 9wickets and, for higher-level contacts, a guide to checking a master agent’s ID and number, instead of a number that someone sent you.
What if you lose your phone?
This is where backup codes matter. With them you can sign in once and move 2FA to your new phone. Without them, recovery can take days. If your phone is stolen, call your operator to block the SIM, then use another device to sign in to your email with a backup code and change your password.
Common mistakes to avoid
- Saving backup codes only on the same phone you might lose.
- Using the same password everywhere, so one leak opens every account.
- Turning 2FA off “temporarily” and forgetting to switch it back on.
- Approving a login prompt you did not start.
Bottom line
Two-step verification is the single most useful security setting most people have not turned on. Start with your email and WhatsApp today, keep your backup codes on paper, and never read a code out to anyone.
