A 2SV check for your important accounts

Why This Topic Matters

Passwords can leak even when you have tried to be careful. A service may suffer a breach. A phishing page may catch someone at the wrong moment. An old reused password may still be floating around from years ago.

Two-step verification gives important accounts another layer. A password alone should not be enough.

The NCSC guidance on turning on 2-step verification recommends using it on important accounts, including email, banking, social media and shopping.

What To Check First

Start with the accounts that would cause the most disruption if someone else got in.

Check:

• your main email account
• banking and payment accounts
• shopping accounts that store cards or addresses
• social accounts that people would trust if a message came from you
• cloud storage and password manager accounts

This is not about reviewing every account in one sitting. It is about protecting the accounts that other accounts rely on.

Choose The Better Option When You Can

Different services offer different forms of two-step verification. Some use an app. Some use a code. Some support a security key or passkey. Some still rely on SMS.

The best option is the strongest one you can realistically keep using. If an authenticator app or passkey is available and you can manage the backup process, that is usually better than relying only on text messages.

The routine I would use is:

1. switch on 2SV for email first
2. save recovery codes somewhere safe
3. add a backup method before you need it
4. repeat the process for banking, shopping and social accounts

What Usually Goes Wrong

The common mistake is turning on 2SV without thinking about recovery. That can create a lockout later, especially if you lose a phone, change number or delete an authenticator app.

Security should reduce panic, not create a new one. Recovery codes and backup methods are part of the setup, not an optional extra.

A Better Baseline

A safer baseline is simple: if an account protects money, identity, communication or stored files, it should have two-step verification switched on.

You do not need to solve everything today. Start with the account that would cause the biggest mess, then work down the list.