# Two-factor authentication: how to switch it on, and which accounts come first URL : https://skillrung.com/en/guides/cybersecurity/two-factor-authentication-how-to Topic: Cybersecurity · Updated on 2026-09-11 ## In brief Two-factor authentication adds a second proof to your password: a temporary code, a notification to approve, or a physical security key. A stolen password is then no longer enough to get in. Switch it on first for your work email, then for your banking and payment access and your work tools. You do it in each service's security settings, and it takes about five minutes per account. ## What is two-factor authentication? Two-factor authentication means proving who you are twice before an account opens: something you know, your password, and something you have, almost always your phone. The service only lets you in when both proofs are present. On screen it goes by several names, *two-step verification*, *2FA* or *MFA*, and they all mean the same thing. Its value fits in one sentence: it breaks the only attack scenario that works at scale. A password travels. It gets guessed, it turns up in a data leak, it gets typed into a fake site. With a second factor, whoever picks it up hits a wall: they do not have your phone. ## Key points - A stolen password is no longer enough to open a protected account. - Start with your email: it resets every other account you own. - Prefer an authenticator app or a physical key to SMS codes. - Write down and file the backup codes the day you switch it on. - An approval request you did not trigger means your password has been compromised. - Allow five minutes per account, in the security settings. ## Which accounts should you start with? Order matters more than completeness. Protect first whatever protects the rest. 1. **Your work email.** It is the master key: whoever controls it can request a reset of all your other passwords, and receives the confirmation links. Access to your mailbox is also enough to send your accountant a transfer request in your name. 2. **Your banking and payment access.** Business bank account, invoicing platform, online payment tool. 3. **Your online work tools.** Management software, shared storage, calendar, appointment booking tool, electronic filing portal. 4. **Your administrative accounts.** Employer portal, tax portal, online filing platforms. 5. **Your sensitive personal accounts**, in particular your personal email if it serves as the recovery address for a work account. If you only have time for one account today, do your email. ## Which method should you choose? Services generally offer three options. They are not equal. ### Codes by SMS This is the most widespread method and the weakest of the three, but it is still infinitely better than nothing. Its limit: an attacker can have your number transferred to a SIM card they control, or call you posing as your IT department and ask you to read out the code. Remember one simple rule: **a code received by SMS is never shared with anyone**, including someone who calls you and knows your name, your role and the file you are working on. ### Authenticator apps An app installed on your phone displays a six-digit code that changes every thirty seconds. It works without network coverage, does not depend on your mobile operator, and cannot be hijacked by a number transfer. It is the right compromise for the vast majority of professionals. Some services replace the code with a notification you approve with a tap, which gives the same level of protection. ### Physical security keys A small object you plug into the device or hold near it. It is the most robust method, and the only one that resists a perfectly imitated fake site, because the key itself checks the site's address before answering. It is worth it for the accounts whose compromise would stop your business: management, accounting, administration of your tools. ## How do you switch it on, in practice? The steps are the same everywhere, give or take the wording. 1. Open your **account settings**, then the *Security*, *Sign-in* or *Privacy* section. 2. Look for **Two-step verification**, *Two-factor authentication* or *2FA*. 3. Choose the method. If an authenticator app is offered, take it. 4. Scan the code shown on screen with your app, then enter the six-digit code it gives you to confirm. 5. **Save the backup codes.** The service offers you a list of single-use codes. Print it or copy it out, and keep it away from the computer: in a locked drawer, or in your password manager if you use one. 6. Sign out, sign back in, and check that the second-factor prompt appears. Step 5 is the one people skip, and the one that costs the most: without backup codes, a lost phone locks you out of your own account. ## What if you lose your phone? Three ways out exist, and it is far better to have prepared one before the incident. - **The backup codes** written down at activation. This is the fastest route. - **A spare second factor** registered in advance: a second device, a physical key kept at the office, or a confirmation phone number. - **The service's account recovery procedure**, which requires identity checks and often takes several days. This is the last resort. If the lost device belongs to your employer, report the loss immediately, before you even think about your own access: the remote wipe is triggered on their side. ## What if you receive an approval request you did not trigger? That notification is an alarm, not a nuisance. It means someone has your password and has just used it. Decline the request. Then change that password from another device, and change it everywhere you had reused it. Next, tell whoever is in charge of IT in your organisation, or your manager if there is no one. Some attacks consist precisely of repeating the request dozens of times, at night, until the target approves out of weariness: never approve just to make the notifications stop. ## Is two-factor authentication enough? No, and it needs saying plainly. It neutralises password theft, not the rest: a fraudulent message that gets you to wire money needs no access to your accounts at all, and ransomware gets in through a software flaw, not through a login page. The second factor is one brick out of four: unique passwords, second factor, updates installed, offline backups. To build the whole set, the course [Cybersecurity essentials: protecting your job](/formations/cybersecurite/fondamentaux-cybersecurite) covers these four habits with cases from your own job, and the course [Phishing: simulator, wire transfer fraud and deepfakes](/formations/cybersecurite/phishing-avance-simulateur) deals with the specific case of fraudulent messages, which the second factor does not block. ## Special cases depending on your job Some situations change what to do. - **An account shared by several people** (a switchboard, a contact mailbox, an on-call login) raises a real problem: who receives the code? The right answer is to remove the shared account and create named logins with the appropriate rights, rather than inventing a workaround for the second factor. [Medical secretaries](/metiers/sante/secretaire-medicale) and [town clerks](/metiers/collectivites-elus/secretaire-de-mairie), who often manage the mailbox of a whole practice or town hall, are the first affected. - **A personal phone used to approve work access.** This is fine if your employer accepts it, but the reverse must be possible: always set up a fallback method that does not depend on your personal device. - **A business without an IT department.** For a [skilled tradesperson](/metiers/industrie-btp-artisanat/artisan) or a [small business owner](/metiers/tpe-independants/dirigeant-tpe), nobody will unlock the account for you: backup codes kept somewhere other than the office are not one more precaution, they are your spare keys. - **Workstations used by several staff in turn.** The second factor belongs to the person, never to the workstation. Each person opens their own session, approves with their own phone, and closes the session when they leave. ## Where to start, if you remember only one thing Open the security settings of your work email, switch on two-step verification with an authenticator app, write down the backup codes and keep them away from the computer. That quarter of an hour takes the most common attack scenario against professionals off the table. ## Frequently asked questions ### Is two-factor authentication mandatory? No general law requires it of every professional. Some services do demand it, banks in particular, and the French data protection authority (CNIL) recommends it whenever an account gives access to personal data. In practice, your insurer or your client may also require it by contract. Treat it as expected, even without a direct legal obligation. ### Are SMS codes really less secure? Yes, because a phone number can be diverted to another SIM card, and a code read out over the phone to a fake IT department opens the account immediately. An authenticator app avoids both risks. That said, a second factor by SMS protects infinitely better than a password alone: do not give up on SMS for lack of anything better. ### What if I lose the phone that generates the codes? Use the backup codes written down at activation, or a spare second factor registered in advance. Failing that, start the service's account recovery procedure, which requires identity checks and often takes several days. If the device belongs to your employer, report the loss immediately so that a remote wipe can be triggered. ### Should I switch it on for an account shared by several people? The real answer is to remove the shared account. One named login per person, with matching rights, settles both the second-factor question and the traceability question. If the sharing is temporary, tie the second factor to an identified work phone, and change the setup as soon as someone leaves the team. ### Does two-factor authentication protect against phishing? Only partly. It blocks later use of a stolen password, but a well-built fake site can ask for your code straight after and use it immediately. Only a physical security key resists this scenario, because it checks the site's address itself. Staying alert to links remains essential. ## Sources - Mots de passe : une nouvelle recommandation pour maîtriser sa sécurité : CNIL, 2022-10-14, https://www.cnil.fr/fr/mots-de-passe-une-nouvelle-recommandation-pour-maitriser-sa-securite - Les 10 mesures essentielles pour assurer votre cybersécurité : Cybermalveillance.gouv.fr, 2026-05-07, https://www.cybermalveillance.gouv.fr/tous-nos-contenus/bonnes-pratiques/10-mesures-essentielles-assurer-securite-numerique - Guide des bonnes pratiques de l'informatique : ANSSI, 2024-03-01, https://cyber.gouv.fr/publications/guide-des-bonnes-pratiques-de-linformatique