Best How to Do Two-Factor Authentication on Any Account
Set up 2FA on Facebook, Instagram, WhatsApp, Google, Apple ID, Discord, Fortnite and Warframe in under an hour. Step-by-step with backup codes.
# How to Set Up Two-Factor Authentication on Any Account
A reader in Manchester emailed us last week with a confession: someone had logged into their Facebook from Vietnam, changed the recovery email, and locked them out of fifteen years of photos. The whole breach took four minutes. Turning on [two-factor authentication](/blog/your-password-is-probably-123456-here-s-how-to-fix-it-before-the-next-breach) would have stopped it cold. Doing that across every account you own takes about 45 minutes, and the best how to do it is to work in one sitting, platform by platform, with your phone beside you. Here is the exact sequence we use, from Facebook and Instagram to Warframe and Fortnite.
## What you'll need
- **Time:** 40 to 60 minutes for the core accounts, plus 10 minutes for the gaming and chat platforms.
- **A phone you control:** iPhone or Android. This is your second factor. Do not use a work phone you might lose access to.
- **An authenticator app:** Google Authenticator, Authy, or Microsoft Authenticator. All free. We prefer Authy for the encrypted backup, though Google Authenticator now syncs too.
- **Backup codes:** Every platform generates them. You will save them somewhere offline. This is not optional.
- **A [password manager](/blog/how-to-protect-yourself-after-a-data-breach-a-step-by-step-privacy-playbook):** Bitwarden (free) or 1Password ($2.99/month). You will be rotating passwords as you go.
- **Email access:** You will need to confirm codes on the address tied to each account.
- **Budget:** $0. Everything here is free unless you want a paid [password manager](/blog/your-data-after-a-breach-a-practical-response-plan-for-normal-people).
## Step-by-step
### Step 1. Secure your email first, because everything else depends on it
Your email is the master key. If someone owns your inbox, they can reset every other account you are about to lock down.
Open your email provider's security settings and enable 2FA there before you touch anything else. For Gmail, that means signing into myaccount.google.com, clicking **Security** in the left sidebar, then **2-Step Verification** under "How you sign in to Google."
- Choose **Authenticator app** over SMS. SIM-swap attacks are real and rising in the UK and US.
- Scan the QR code with your authenticator app, then enter the six-digit code to confirm.
- Add a backup phone number as a fallback, even if you never plan to use it.
**Watch out:** If you are still using SMS codes as your only second factor, you are only marginally safer than having no 2FA at all. Move to an app or a hardware key.
### Step 2. Lock down your Google account fully
Google holds your mail, your photos, your Android backups, and often your identity across the web. Treat it as the crown jewel.
From the same **Security** page, work through these in order:
- **Recovery options:** Add a backup email and phone number you actually control.
- **Passkeys:** Google now supports passkeys on iOS and Android. Set one up under **How you sign in to Google**. It is faster than a code and phishing-resistant.
- **Backup codes:** Click **Backup codes**, generate a set of ten, and print them. Store the printout somewhere physical, not in your Notes app.
**Tip:** Google's Advanced Protection Program is free and worth it if you are a journalist, activist, or anyone with a public profile. It forces hardware keys. Overkill for most, essential for some.
### Step 3. Turn on 2FA for your Apple ID
This is the account that unlocks your iPhone, your iCloud photos, and your App Store purchases. Apple calls it two-factor authentication and it is on by default for newer accounts, but plenty of older ones still have it off.
On iPhone, open **Settings**, tap your name at the top, then **Sign-In & Security**, then **Two-Factor Authentication**. Tap **Turn On Two-Factor Authentication**.
- Apple will text a code to a trusted number. Enter it.
- Add a second trusted phone number if you have one. Losing your only trusted device with no backup number is a genuine nightmare.
- On a Mac, the same setting lives under **System Settings > [your name] > Sign-In & Security**.
**Watch out:** Apple does not support third-party authenticator apps for your [Apple ID](/blog/stolen-device-protection-why-it-makes-your-passwords-safer). It uses its own system. That is fine, but it means your Apple ID recovery plan needs its own attention.
### Step 4. Secure Facebook, Instagram, and WhatsApp together
Meta runs all three, and the settings rhyme. Do Facebook first, since it is usually the oldest account.
On Facebook: click your profile picture, then **Settings & privacy > Settings > Password and security > Two-factor authentication**. Choose **Authentication app** and scan the QR code. Save the recovery codes.
On Instagram: go to **Settings and activity > Accounts Center > Password and security > Two-factor authentication**. Pick the account, then **Authentication app**. Same drill.
On WhatsApp: open **Settings > Account > Two-step verification > Enable**. You will set a six-digit PIN. This PIN is not the same as your SMS code, and WhatsApp will ask for it periodically.
**Tip:** WhatsApp's PIN protects your number from being re-registered on another phone. If you ever forget it, you can reset via email, so make sure your recovery email is current.
### Step 5. Add 2FA to Discord
Discord is where a lot of account theft happens, mostly because people reuse passwords and lose their servers and payment methods in one go.
Open Discord, click the **gear icon** next to your username at the bottom left, then **My Account > Two-Factor Auth > Enable Two-Factor Auth**.
- Scan the QR code with your authenticator app.
- Enter the code, then download the backup codes. Discord gives you ten.
- Enable **Require 2FA for moderation actions** if you run a server. This stops a compromised mod account from nuking your community.
**Watch out:** If you lose your phone and your backup codes, Discord support is slow. Store those codes properly.
### Step 6. Protect your gaming accounts, starting with Fortnite and Warframe
Game accounts get targeted because they hold purchased currency and rare items. Both Epic Games and Warframe have solid 2FA, and both reward you for turning it on.
For Fortnite and Epic Games: go to **epicgames.com**, sign in, then **Account > Password & Security > Two-Factor Authentication**. Enable it via authenticator app. Epic also gives you the **Boogie Down** emote for free once 2FA is active. That is a real, permanent cosmetic for five minutes of work.
For Warframe: log into **warframe.com**, go to **Account Management > Two-Factor Authentication**, and enable it. Digital Extremes requires 2FA for trading, so if you ever want to trade platinum, you need this anyway.
**Tip:** Steam, Riot, and Blizzard all have equivalents. If you play anything with a marketplace, turn it on there too.
### Step 7. Store your backup codes and test the setup
Every platform you just touched handed you recovery codes. They are useless if they are sitting in a browser download folder.
- Print them, or write them into a physical notebook, and store that somewhere you would keep a passport.
- Alternatively, save them to an encrypted vault in your [password manager](/blog/ai-security-crisis-how-hackers-breached-openai-and-what-you-can-do). Bitwarden's free tier handles this fine.
- Then test: sign out of one account, sign back in, and confirm the 2FA prompt appears and your code works.
**Watch out:** Do not skip the test. We have seen people discover their 2FA was misconfigured only when they were locked out.
## Common problems and fixes
**You lost your phone and your backup codes.** Use the account recovery flow, which usually involves a waiting period of several days. This is why you add a second trusted device or number. If you skipped that, contact support and be patient.
**Your authenticator codes are wrong.** Your phone's clock has drifted. Open your phone's date and time settings and enable automatic time sync. TOTP codes depend on accurate time.
**You are locked out of an old account with a dead phone number.** Most platforms let you appeal with ID. Meta's process takes days to weeks. Google's is faster if you have a recovery email. This is the single strongest argument for adding a backup email to everything today.
**SMS codes never arrive.** Your carrier is filtering them, or you are roaming. Switch to an authenticator app and stop relying on SMS entirely.
**A platform refuses your authenticator app.** Some older services only support SMS. If the service matters, use a VoIP number dedicated to 2FA, but know that some banks block VoIP numbers.
## What to do next
- **Buy a hardware security key.** A YubiKey 5 NFC runs about $55 in the US and £50 in the UK. Google, Facebook, and many others accept it. It is phishing-proof in a way codes are not.
- **Rotate your passwords.** 2FA does not fix a reused password. Run through your password manager and change anything that appears on more than one site.
- **Check haveibeenpwned.com.** Enter your email addresses and see what has already leaked. It tells you where to prioritize.
## Our take
If you do nothing else, do three things: enable an authenticator app on your Google account, turn on Apple's two-factor authentication, and set the WhatsApp PIN. Those three cover the accounts most likely to ruin your week if breached. The gaming accounts can wait a day. The hardware key can wait a month. The backup codes cannot wait at all, so print them before you close this tab.
## FAQ
**Is two-factor authentication with SMS better than nothing?**
Yes, but barely. SMS is vulnerable to SIM-swap attacks, which are common enough in the US and UK that we treat SMS-only 2FA as a stopgap. Use an authenticator app or a hardware key wherever the platform allows it.
**What happens if I lose my phone with 2FA enabled?**
If you saved your backup codes and added a second trusted device or number, recovery takes minutes. If you did neither, you are looking at account recovery appeals that can take days or weeks. Save the codes.
**Do I need 2FA on Fortnite and Warframe?**
You do not strictly need it, but both platforms gate trading and account security behind it, and both are frequent targets for credential-stuffing attacks. Fortnite throws in a free emote. Warframe requires it for platinum trading. Turn it on.
Frequently asked questions
Is two-factor authentication with SMS better than nothing?
Yes, but barely. SMS is vulnerable to SIM-swap attacks, which are common enough in the US and UK that we treat SMS-only 2FA as a stopgap. Use an authenticator app or a hardware key wherever the platform allows it.
What happens if I lose my phone with 2FA enabled?
If you saved your backup codes and added a second trusted device or number, recovery takes minutes. If you did neither, you are looking at account recovery appeals that can take days or weeks. Save the codes.
Do I need 2FA on Fortnite and Warframe?
You do not strictly need it, but both platforms gate trading and account security behind it, and both are frequent targets for credential-stuffing attacks. Fortnite throws in a free emote. Warframe requires it for platinum trading. Turn it on.
Tech-N-AI Talks
