Turn on two-step sign-in for your family's key accounts

By the end of this guide, every adult in your household will have two-step sign-in on the accounts that matter most, with backup codes stored somewhere safe, so a stolen password alone can't take an account over.

Who it's for

Anyone who looks after the technology for their household, including parents and grown children helping older relatives. You'll need each person's phone, their passwords (or a password manager), and about 15 minutes per person.

Why bother: most account takeovers start with a password that leaked from some other website. With two-step sign-in, the password alone isn't enough: the thief also needs your phone or security key.

Steps

1. List the accounts that matter

   For each person, write down the accounts that would hurt most to lose. Start with email, because it can reset every other password. Then the Apple Account or Google Account on their phone, banking and investments, the mobile phone carrier, Amazon and other shopping accounts with saved cards, and social media.

2. Pick a second step better than a text message

   Where an account offers it, use a passkey or an authenticator app (such as Google Authenticator, Microsoft Authenticator, or the one built into your password manager) instead of text-message codes. Text messages are better than nothing, but a thief can sometimes move a phone number to their own SIM card.

3. Start with email

   Sign in to the email account on a computer, open its security settings (look for "2-Step Verification" or "Two-step sign-in"), and follow the steps to add the phone. Check the recovery phone number and recovery email while you're there: they must be ones the person still uses.

4. Save the backup codes

   Most services offer a set of one-time backup codes. Print them or write them down, label them with the account, and keep them somewhere safe at home, or store them in your password manager. They get you back in if the phone is lost, broken or replaced.

5. Work down the list, then add a carrier PIN

   Repeat for each remaining account on the list. Then call the mobile carrier, or use its app, to set a PIN or turn on number-transfer protection, so nobody can move the phone number without it.

6. Do the same for everyone else

   Sit with each adult in the household and go through the same steps on their own phone, so they know what the prompts look like. Explain the one rule: if you get a sign-in prompt or code you didn't ask for, say no and change your password.

Common mistakes

• No backup codes. Without them, a lost phone can lock someone out for days or for good. Save them the moment you turn two-step sign-in on.
• Approving a prompt you didn't start. Attackers who have the password send prompts again and again, hoping you'll tap Yes to make them stop. Never approve a sign-in you didn't begin.
• An old recovery email or phone number. If the recovery address is an old email account nobody checks, whoever takes it over can take over the main account too.
• Setting it up on your phone for someone else. Each person's second step should be on their own device, unless you're deliberately managing an account for them, such as a young child's.
• Stopping at email. Email matters most, but a bank or carrier account without two-step sign-in is still exposed. Work through the whole list.