A combination padlock resting on a laptop keyboard

Two-Step Login Made Simple: Protect the Accounts That Hold Your Money

ByHarold Jennings

When you start earning a little money on the side, more of your life moves online: an email address for customers, a PayPal or bank app, maybe an account on a selling site. Each of those accounts is protected by a password. A password alone, though, is easier to steal than most of us would like.

That is where two-step login comes in. It sounds technical, but the idea is simple, and turning it on usually takes a few minutes per account. This guide explains what it is, which kind to choose, and where to start.

What “two-step login” means

You may see it called two-factor authentication, two-step verification or multi-factor authentication (MFA). They all mean the same thing: to sign in, you need your password plus a second proof that it is really you.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) describes three kinds of proof:

  • Something you know, like a password or PIN.
  • Something you have, like your phone, which receives a code.
  • Something you are, like your fingerprint or face.

The point is that a thief who gets your password still cannot get in without the second step. CISA says people who use MFA are significantly less likely to be hacked.

The three common kinds of second step

The Federal Trade Commission (FTC) explains the main choices. Here they are in plain terms.

1. A code sent by text message or email

After you type your password, the website sends a short code, usually six digits, to your phone or email. You type it in, and you are signed in. The code works only once and expires quickly.

This is the easiest kind to use. The FTC notes one weakness: in a “SIM swap,” a criminal tricks a phone company into moving your number to their phone, so they receive your texts. Even so, the FTC says a text code is better than nothing.

2. An authenticator app

This is a free app on your phone, such as Google Authenticator, Microsoft Authenticator or Duo, that shows a fresh code that keeps changing. Some send a pop-up asking you to approve a sign-in with one tap. Because the code is made on your phone, not sent by text, it avoids the SIM-swap problem.

3. A security key

This is a small physical device that plugs into a computer or taps against a phone. The FTC calls it the strongest option. It is a good choice for people comfortable with a little extra setup, but you do not need one to be much safer than you are with a password alone.

Where to turn it on first

You do not have to do every account in one afternoon. Both the FTC and CISA suggest starting with the accounts that matter most. A sensible order:

  1. Your email. Password-reset links and many codes go to your email, so protect it first, with a strong password and two-step login.
  2. Your bank and credit card accounts.
  3. Payment apps such as PayPal, Venmo or Zelle through your bank.
  4. Any selling or side-gig sites where you get paid.
  5. Social media and online shopping accounts.

How to switch it on, step by step

Every website looks a little different, but the steps are usually similar:

  1. Sign in to the account on your computer or in its app.
  2. Find “Settings,” “Security” or “Account,” often under your name or a small person icon.
  3. Look for “Two-step verification,” “Two-factor authentication” or “Multi-factor authentication.” The FTC notes it is usually turned off until you switch it on.
  4. Choose how you want to get your second step: a text, an authenticator app or a security key.
  5. Follow the prompts. Many sites give you a few “backup codes.” Write them down and keep them somewhere safe at home, in case you lose your phone.

Some sites offer to “remember this device” so you are not asked for a code every time. The FTC says that is fine on your own phone or computer, but never on a shared or public computer, such as one at a library.

If an account does not offer two-step login at all, CISA suggests asking the company to add it.

The one rule that stops most scams

Never give a login code to anyone who contacts you first, no matter who they say they are: your bank, a delivery company, a buyer on a selling site or even a family member in a hurry. The FTC warns that scammers often try to talk people into reading out these codes. A real company does not need the code you just received; only the person signing in does.

If someone asks for a code, hang up or stop replying. Then contact the company yourself using the number on your card, statement or official website.

If you think an account was broken into

Change that account’s password right away, as the FTC advises. If you used the same password anywhere else, change it there too. Then turn on two-step login if it was not already on, and check the account for changes you did not make.

Why this belongs in your side-income plan

The money you earn on the side only helps cover a bill if it reaches you and stays put. Ten minutes spent on two-step login for your email and payment accounts is one of the simplest ways to protect it.

More on Replace a Bill

Sources

Similar Posts