Accounts & passwords
Turn on two-step verification: which accounts first, and how
Two-step verification, also called multi-factor authentication or MFA, means a stolen password isn’t enough to get into your account. It takes a few minutes per account and stops most account takeovers. Here’s where to start and which option to pick.
The short version
Do these accounts first
- Your main email.
- Banking and myGov.
- Your Apple, Google or Microsoft account.
- Your password manager and social media.
What it actually does
When you sign in, you enter your password and then prove it’s you a second way, such as a code from an app, a tap on your phone, or a fingerprint. Someone who has stolen or guessed your password still can’t get in without that second step.
The Australian Signals Directorate lists multi-factor authentication as one of the most effective things you can do to protect your accounts.
Which accounts first
Start with the accounts that unlock other accounts, or hold money.
| Priority | Account | Why |
|---|---|---|
| 1 | Your main email | Password resets for everything else go here. |
| 2 | Banking and super | Direct access to your money. Most banks already require a second step. |
| 3 | myGov | Links to tax, Medicare and Centrelink. myGov supports passkeys and other strong sign-in options. |
| 4 | Apple ID, Google or Microsoft account | Controls your phone, backups, photos and saved passwords. |
| 5 | Your password manager | Holds the keys to everything else. |
| 6 | Your mobile carrier account | Helps protect against your number being moved to a scammer’s SIM. |
| 7 | Social media and shopping sites | Commonly hijacked for scams, and may store your card. |
| 8 | Work accounts | Usually managed by your workplace. If not, ask. |
Which method to choose
From strongest to weakest:
Passkeys and security keys
A passkey or physical security key can’t be phished, because it only works on the real website. If an account offers passkeys, they’re a great choice. See our passkeys guide.
Authenticator apps
Apps like Microsoft Authenticator, Google Authenticator or the one built into your password manager show a code that changes every 30 seconds, or ask you to approve a sign-in with a number match. Much stronger than text messages.
Text message codes
Codes by SMS are far better than nothing, but they can be intercepted or stolen through SIM swap fraud, and people can be tricked into reading them out. Use them where nothing else is offered.
Never share a code, and never approve a prompt you didn’t start
No genuine bank, company or IT team will ask for the code you’ve just received. If you get a sign-in prompt you weren’t expecting, deny it and change your password, because someone else has it.
How to turn it on
The setting is usually in the account’s Security or Sign-in section. Look for two-step verification, two-factor authentication, 2FA, MFA or passkeys.
Set up the method
Scan the QR code with your authenticator app, add your phone or create a passkey, then enter the code to confirm it works.
Save your backup codes
Most services give you a set of one-time backup codes. Store them in your password manager or print them and keep them somewhere safe. They’re how you get in if you lose your phone.
Add a second method if offered
A second phone, a security key or a backup authenticator means losing one device doesn’t lock you out.
If you get a new phone
Before you wipe or trade in your old phone, move your authenticator app to the new one. Microsoft Authenticator, Google Authenticator and most password managers have a backup or transfer option. Check each important account still works on the new phone before you reset the old one.
For businesses
- Require MFA for every staff account in Microsoft 365 or Google Workspace, not just admins.
- Use phishing-resistant methods like passkeys or security keys for admin accounts.
- Turn on MFA for remote access, accounting software, banking and your domain registrar.
- Make sure staff know what to do when they get a prompt they didn’t expect.
Common questions
Isn’t this a hassle every time I log in?
Most services only ask for the second step on a new device or every few weeks. On your own phone or computer, you’ll rarely notice it.
What if I lose my phone?
Use your backup codes, a second registered device or the service’s account recovery process. That’s why saving backup codes matters.
Is MFA through text messages useless?
No. It still blocks most automated attacks. An app or passkey is better, so upgrade when you can.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.