Two-factor authentication (2FA), also called two-step verification, asks for a second proof besides your password, so a stolen password alone does not open the account. A passkey goes further: it replaces the password with a key stored on your device and unlocked with your fingerprint, face or screen lock. When you have a choice, pick a passkey or security key first, then an authenticator app or an in-app prompt, and keep text messages for when nothing else is offered.
Two-step verification and passkeys: what changes in practice
With two-step verification you type your password, then prove it is you with something only you have (a code, a phone prompt, a physical key) or something you are (fingerprint, face). The weak spot of codes is that you type them: on a fake page that imitates the login, the scammer receives the code and uses it at once. NIST's SP 800-63B-4 says that codes a person types in, whether from an app or a text message, are not phishing-resistant, and names WebAuthn, the standard behind passkeys, as an example of one that is. It was written for US federal systems, so treat it as a technical benchmark, not a rule for your shop. With a passkey, the private key never leaves your device and works only for the real site, so there is nothing to hand over.
The five methods side by side
| Method | Strength | Weakness | When to use it |
|---|---|---|---|
| Text message code | Works on any phone, nothing to install | Google warns that codes sent by text or call can be vulnerable to phone-number-based hacks. NIST treats that channel as restricted | Only when nothing else is offered. Still better than a password alone |
| Authenticator app | Generates the code with no internet or signal | The code is also typed, so a fake site can fool you. Move your codes before changing phones | The default when you have no passkey yet |
| Push prompt | One tap, no typing. Google recommends its prompts to people who do not use a passkey | CISA warns about push bombardment, where a scammer fires requests until someone approves one, and points to number matching | When the service shows a number to match. Deny any prompt you did not start |
| Security key | Physical device that Google says protects against phishing | Costs money. If you lose it you need another way in: a second key or backup codes | Owners, admins and accounts that move money |
| Passkey | No password to leak or type. Phishing-resistant. Can live on your phone, computer, password manager or a physical key | Depends on where it is saved and who can unlock that device. Create it only on one you own | Whenever the service offers it |
Sources: Google, CISA and NIST SP 800-63B-4.
How to turn it on, service by service
Menu names change by version and language. The paths below are copied from the official pages.
Google (Gmail, Drive, Business Profile)
Open your Google Account, go to Security & sign-in and, under How you sign in to Google, choose Turn on 2-Step Verification. For a passkey, go to myaccount.google.com/signinoptions/passkeys and choose Create a passkey, only on a device you own. If you do not use a passkey, Google's help page recommends its prompts over text messages. Work accounts may be controlled by an administrator.
Apple (Apple Account)
On an iPhone or iPad, go to Settings, tap your name, then Sign-In & Security, and turn on two-factor authentication (on a Mac, System Settings). On the web, sign in at account.apple.com and choose Upgrade Account Security. According to Apple's page, an account created with two-factor authentication cannot have it removed, and if you turned it on recently you have two weeks to go back. Apple also suggests a trusted phone number that is not your iPhone's.
Microsoft (Outlook, Microsoft 365)
Go to account.microsoft.com/security, choose Manage how I sign in, then under Additional security choose Two-step verification and Turn on. For a passkey, go to account.live.com/proofs/manage, choose Add a new way to sign in or verify, then Face, Fingerprint, PIN, or Security Key. Microsoft recommends keeping three pieces of security info on the account.
WhatsApp and WhatsApp Business
In WhatsApp settings, open Account, then Two-Step Verification. Create a six-digit PIN and add an email address so you can reset it if you forget it. That PIN is not the 6-digit code sent by text, and WhatsApp's help center says never to share either one (see the 6-digit code scam). The Business app uses the same path, and WhatsApp's business page says to update the PIN when a team member leaves and to use Meta Business Suite to share the inbox without sharing your login or phone number. Account already taken? See WhatsApp Business hacked. The passkey WhatsApp announced in October 2025 protects chat backups, not the login.
Instagram and Facebook
Meta's help center blocks automated reading, so this guide does not quote menu names we could not check. The official page, Securing Your Meta Account With Two-Factor Authentication, is in the sources below. Follow what it shows and, if an authenticator app is offered, pick it over text messages.
Your bank's app
Each bank sets its own options, so follow the steps in its own app. Use only the official app and turn on whatever it offers to confirm logins and transactions. Never read out a one-time code or token to anyone who calls, texts or emails you.
Backup codes and what to do if you lose your phone
Backup codes are your spare door. At Google each set has 10 single-use codes, and creating a new set turns the old one off. Keep them somewhere safe, such as with important documents, and never share them. For a business, use a locked cabinet and note who knows where it is.
If you lose your phone, work through this list:
- Change your password and sign out of the lost phone, as Google advises.
- Use another way in that is already set up: a second signed-in phone, a backup code, a security key or a passkey on another device.
- Save your number. Ask your carrier to move the line to a new SIM, as Google suggests.
- WhatsApp: install it on the new phone and verify your number. The app asks for the PIN and, if you forgot it, there is a Forgot PIN option. If it asks for a PIN you never created, the official page says to wait 7 days before resetting it.
- Apple and Microsoft: with no trusted device or number, Apple says a few days or longer (contacting Apple does not speed it up) and Microsoft says 30 days.
With no second step left, Google account recovery can take 3 to 5 business days. If someone already got in, follow what to do if your email is hacked. AI tools connected to your email or Drive are one more access to review, as AI security for small business explains.
15-minute checklist for a small team
CISA says to prioritize email, financial services, social media and online stores. Any multi-factor authentication is better than none, and the FTC's cybersecurity basics tell small businesses to require it for areas of the network that hold sensitive information.
- 2 min: list the accounts that move money or customers. Email, bank, WhatsApp Business, Instagram, Facebook, online store and your domain.
- 4 min: email first, for every person. In Google Workspace, an admin can require it in the Admin console (Menu, Security, Authentication, 2-step verification), with an enrollment period and a report of who has enrolled; blocking text codes locks out anyone who only uses text. In Microsoft 365, turn on security defaults in the Microsoft Entra admin center (Identity, Overview, Properties); tenants created after October 2019 already have them on.
- 2 min: WhatsApp Business. Six-digit PIN, recovery email and a review of linked devices.
- 2 min: Instagram and Facebook. Turn it on from Meta's official page and prefer an authenticator app over text messages.
- 2 min: bank. Official app only, with the confirmation options your bank offers. Agree that nobody shares a code or token.
- 2 min: backup codes. Print the ones for your main email and lock them away.
- 1 min: test. Sign out of one account and back in. Check that the recovery email and phone belong to the company, not to one employee's personal phone.
Admin steps follow the Google Workspace and Microsoft help pages in the sources. Menus change, so check before you apply them.
Frequently asked questions
Is a text message code still worth using?
It beats having nothing: CISA says any multi-factor authentication is better than none. But Google warns that codes sent by text or call can be vulnerable to phone-number-based hacks, so switch to a passkey, an in-app prompt or an authenticator app as soon as the service allows.
Does a passkey replace two-step verification?
At Google, signing in with a passkey skips the second step, because it already confirms the device is yours. Each service has its own rules, and an administrator can limit passkeys on work accounts. Check each service's official page.
Do I need to buy a physical security key?
No. A passkey on your phone or computer already resists phishing. A physical key is optional and makes the most sense for owners, administrators and accounts that move money.
What if I lose my phone and have no backup codes?
Try another signed-in device, a security key or a passkey on another device. With none of them, use the service's account recovery: Google says 3 to 5 business days, Apple a few days or longer and Microsoft 30 days.
Sources: CISA: Multifactor Authentication (More than a password) · FTC: Cybersecurity Basics for small business · NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management (July 2025) · Google: Turn on 2-Step Verification · Google: Sign in with a passkey instead of a password · Google: Sign in with backup codes · Google: Fix common issues with 2-Step Verification, including a lost phone · Google Workspace: Deploy 2-Step Verification (admins) · Apple: Two-factor authentication for Apple Account · Apple: About trusted phone numbers and trusted devices · Apple: About the security of passkeys · Microsoft: How to use two-step verification with your Microsoft account · Microsoft: Signing in with a passkey · Microsoft: Set up multifactor authentication for Microsoft 365 (admins) · WhatsApp Help Center: verification codes and two-step verification · WhatsApp Business: Protecting your business on WhatsApp, security best practices · Meta (WhatsApp): Making it easier to encrypt your WhatsApp chat backups (October 2025) · Instagram (Meta): Securing Your Meta Account With Two-Factor Authentication · FIDO Alliance: Passkeys
