Turn on two-step verification safely
Two-step verification adds another check when signing in, helping protect an account if its password is stolen. Providers may call it 2SV, two-factor authentication or multi-factor authentication. Start with business email because other accounts often rely on it for recovery, then protect domain, website and payment administration accounts through their official settings.
Before you start
- Check that the account’s recovery email and phone details belong to the business or an authorised owner.
- Set aside time when you can complete and test the setup without interruption.
What to do
Use the provider’s trusted account route
Open the known provider website or application yourself, rather than following an unexpected security-warning link. Find its official security guidance for your account type. Available methods differ, so use the supported process instead of copying instructions intended for another platform.
Choose and enrol the supported method
Follow the provider’s instructions for an authenticator, security key or other available protection. If a passkey is offered, read how its device and recovery arrangements work. Do not disable existing protection simply because a supplier says it makes access inconvenient.
Keep recovery independent of the device
Store any recovery codes securely and establish the provider’s supported backup method. For a business, document who can recover access without circulating the codes. Consider the practical case of a lost phone on the day a domain renewal or urgent website change is needed.
Test before ending the existing session
Confirm that the new sign-in method works using the supported test or another authorised session. Keep the original session available until you have verified access. Update the business access record with the method and responsible person, never the secret code itself.
What to check
- The important account has additional sign-in protection enabled.
- Recovery does not depend entirely on the same phone.
- The authorised owner has confirmed they can sign in.
Sources and further reading
Platform features can change. Check the provider’s current guidance before changing a live service.