How to Turn On Multi-Factor Authentication (MFA) for Your Accounts
Why bother
CISA says multi-factor authentication (MFA) provides extra security by confirming your identity when you log in, such as by entering a code texted to a phone or generated by an authenticator app. Even if an unauthorised user steals your password, they will not be able to meet the second-step requirement.
The three steps
- Go to Settings. Look under your account profile. It may be called Account Settings, Profile, Preferences or Privacy. Then open the security settings.
- Find and turn on MFA. It may be called two-factor authentication, two-step authentication or similar.
- Confirm your choice. Pick the method the app offers.
The methods CISA lists
- A numeric code received by text or email.
- An authenticator app: phone apps that generate a new code every 30 seconds.
- Biometrics: facial recognition or fingerprints.
Where to turn it on first
CISA says to turn on MFA for every account or app that offers it, and notes it protects things like banking information, online purchases, social media, email, businesses and your identity. If an important account such as your email or bank does not offer MFA, CISA suggests asking why not.
How it fits with other advice
The US FTC lists MFA as one of four ways to protect yourself from phishing, and explains that it makes it harder for scammers to log in even if they obtain your username and password.
Fact-checked on 30 October 2026 against the sources listed below. Prices and plans change, so confirm with the provider before you buy.
Frequently asked questions
What is MFA?
A login step that confirms your identity beyond your password, such as a code from an authenticator app, per CISA.
How often does an authenticator app code change?
CISA says these apps generate a new code every 30 seconds.
Which accounts should have MFA?
CISA says every account or app that offers it, including banking, email, social media and online purchases.