🎯 What you will learn
- By the end of this lesson you'll know what two-step verification is and why it protects you.
- You'll know the differences between SMS codes, authenticator apps, security keys and passkeys.
- You'll know how to turn on 2FA on most accounts.
- You'll understand why backup codes matter and how to keep them safe.
- You'll be able to tell when someone is trying to steal your code.
What is 2FA?
Two-step verification (also called two-factor authentication, or 2FA for short) means that to log in to an account you need two different proofs that it's really you:
- Something you know – your password or PIN.
- Something you have – your phone or a security key.
- Something you are – your fingerprint or face (biometrics).
Think of it as a door with two locks: even if a burglar finds one key, they still need the other one. According to research by big companies such as Google and Microsoft, 2FA stops the vast majority of automated attacks on accounts.
Types of second step
| Method | How it works | Security |
|---|---|---|
| SMS code | You get a 6-digit code by text message. | Better than nothing, but text messages can be intercepted, or scammers can “take over” your number (SIM swap). |
| The code arrives by email. | Only good if the email account itself is very well protected. | |
| Authenticator app | Apps such as Google Authenticator, Microsoft Authenticator, Authy or Aegis create a new code every 30 seconds. | Strong – the code is created on your own phone and isn't sent by text message. |
| Phone notification | You tap “Yes, it's me” in the app. | Strong, but be careful: never approve it if you're not the one logging in. |
| Security key / passkey | A small USB/NFC device, or a passkey on your phone, that you confirm with your fingerprint, face or PIN. | The strongest – it doesn't work on fake websites, so it also protects you from phishing. |
How to turn on 2FA (in general)
The steps vary a little from one service to another, but they usually go like this:
- Log in to your account and open Settings.
- Look for the Security, Password and security or Sign-in section.
- Choose Two-step verification / Two-factor authentication / 2-Step Verification.
- Choose a method: an authenticator app (scan the QR code with the app), SMS or a passkey.
- Type in the code that appears to confirm it.
- Save the backup codes you're given at the end.
Start with your most important accounts: your email, your phone's Apple/Google account, your social media and any games you've spent money on.
Backup codes: your plan B
What happens if you lose your phone? That's what backup codes are for – a list of codes that can each be used only once and let you log in without your phone.
- Write them down or print them out and keep them somewhere safe at home (for example, with the family's documents).
- You can also store them in your password manager.
- Don't take photos of them and don't send them in a chat.
- If you use an authenticator app, check whether it offers a backup for when you change phones.
When scammers want your code
Scammers know that 2FA stops them, so they try to persuade you to hand over the code yourself. For example:
- “I sent a code to your number by mistake – could you send it to me, please?” – from a friend's account that has been hacked.
- “I'm from Instagram support. Tell me the code so I can verify your account.”
- Lots of “Are you trying to sign in?” notifications one after another – they're hoping you'll tap “Yes” just to make them stop.
📖 A real-life story
Drilona, 14, from Prizren, got an Instagram message from her friend Elira's account: “Hey, a code got sent to your number by mistake – send it to me quick, please!” A few seconds later, Drilona really did get a text message with a code.
Drilona remembered that the code was coming from Instagram for her account, not Elira's. She didn't send it. She phoned Elira and found out that Elira's account had been hacked the day before. Drilona changed her password, turned on 2FA with an authenticator app and reported the hacked account. With her parents' help, Elira got her account back through the official recovery process.
✅ Do / Don't
✅ Do this
- Turn on 2FA for your email, social media, games and phone account.
- Choose an authenticator app or a passkey over SMS.
- Keep your backup codes on paper somewhere safe at home.
- Move your authenticator app across when you change phones.
- Set a passcode or a fingerprint/face lock on your phone.
- Change your password if you get codes you didn't ask for.
- Check the list of devices linked to your account every now and then.
❌ Don't do this
- Don't tell anyone your verification code – not your friends, not “staff”.
- Don't tap “Yes, it's me” if you're not the one logging in.
- Don't keep your backup codes as photos in your gallery.
- Don't turn off 2FA just because it seems like a hassle.
- Don't type your code into a page you reached from a suspicious link.
- Don't leave your phone without a screen lock.
👨👩👧 For parents and teachers
2FA is one of the most effective ways to protect your children's accounts. It's well worth spending 20 minutes on it one weekend.
- Sit down together and turn on 2FA on your child's email and main accounts. For younger children, the second step can be a parent's phone.
- Print out the backup codes and keep them with your family documents.
- Give your child one simple rule: “I never give the code that comes to my phone to anyone. Ever.”
- Teachers can use a test account to show the class what turning it on looks like.
- When anyone in the family changes phones, make sure the authenticator apps have been moved across.
🧠 Mini-quiz
Answer 3 questions. Get at least 2 right and the lesson is marked as completed in your passport.