This isn't a scare tactic. It's a numbers problem.
Thousands of data breaches happen every year. Companies you've done business with — some you'd recognize, some you've never heard of — have had their user databases stolen and sold. Your email address and password combinations from years-old accounts are sitting in files being traded among attackers right now.
Most people don't know their credentials have been exposed until something goes wrong. By then, an attacker has already tried that email and password combination across hundreds of other sites, looking for matches. This is called credential stuffing, and it works because most people reuse passwords.
Two-factor authentication — 2FA — is the reason a stolen password doesn't have to be the end of the story.
The idea is simple. Logging in normally requires one thing: something you know — your password. Two-factor authentication adds a second requirement: something you have.
That second factor is usually a short code that expires quickly. Even if an attacker has your password, they can't get in without the code. And the code is tied to something physical — your phone — that they don't have.
It's the difference between a door with one lock and a door with two. Getting through the first doesn't help if you can't get through the second.
Most services offer more than one way to receive your second factor. They're not equally secure, and it's worth knowing the difference.
Email codes are the weakest option. When your code gets sent to the same email account you're trying to protect — or an account at the same provider — an attacker who already has your password may have access to both. Email codes are better than nothing, but they're not a real solution for accounts that matter.
Text message codes are the most common method and better than email, but they have a specific vulnerability worth understanding. Your phone carrier is a weak link you didn't choose.
A technique called SIM swapping lets an attacker call your carrier, impersonate you convincingly enough to pass their verification, and transfer your phone number to a SIM card they control. From that point on, every text message meant for you — including your 2FA codes — goes to them. This has happened to real people and resulted in real financial losses. It doesn't require any technical skill. It just requires a phone call and enough of your personal information to sound credible.
SMS codes are still worth enabling if an authenticator app isn't available. But they're not the finish line.
Authenticator apps are the right answer. Instead of a code being sent somewhere — over email, over a cellular network, through a carrier — the code is generated directly on your device. No transmission. No carrier involved. No email account to compromise. The code exists only on your phone, changes every 30 seconds, and is mathematically tied to your specific account.
An attacker who has your password and isn't holding your physical phone cannot get in. That's the level of protection worth having.
When a service gives you the option, always choose an authenticator app over text or email codes. It takes about two minutes to set up and works the same way across every service that supports it.
Here's something most people don't expect: having 2FA enabled can make you a target for a specific type of social engineering attack.
It works like this. An attacker already has your username and password — bought from a breach, guessed, or phished. They try to log in, which triggers a real 2FA code to be sent to your phone. Then they call you.
They claim to be from your bank, or Amazon, or Apple, or whoever the account belongs to. They say there's been suspicious activity. They say they're verifying your identity. They ask you to read them the code you just received.
The code is real. The caller is not.
No legitimate company will ever call you and ask for a verification code. Ever. The code exists for you to type into a login screen — not to speak to another person. The moment someone asks you to read a code out loud, the call is a fraud. Hang up.
If you're worried there's a real issue with an account, end the call and contact the company directly through a number you look up yourself — not one the caller provides.
Pick one account that matters most to you — your primary email, your bank, or wherever you store important information — and turn on two-factor authentication. Look for it under Security or Privacy in account settings. If the option exists to use an authenticator app rather than text codes, choose that.
You don't have to do every account today. One is a real improvement. The habit builds from there.
Once 2FA is in place, the next layer worth addressing is how you're storing and managing your passwords across everything else. That's where a password manager comes in — and it's simpler than it sounds.