Susanna Riva Credential theft doesn't just happen with weak passwords: today, criminals exploit phishing, malware, and social engineering to bypass simple logins. The most effective way to prevent this is by combining a passkey and two-factor authentication , which blocks unauthorized access even if the password falls into the wrong hands. This guide offers concrete instructions for activating protections for email, social media, and financial services, with real-world examples and instructions for secure backups.
Passkeys replace passwords with a pair of cryptographic keys tied to your device and your profile; they're phishing-resistant and work with biometrics or a device PIN. 2FA adds additional verification (app OTP , hardware keys, push notifications, or SMS). Choice and configuration matter: incorrect settings can create unexpected lockouts or vulnerabilities.
Enable passkey on email: Google, Apple, Microsoft
Your email inbox is the most critical link: it's where all your account resets and verifications go. On Google, open Google Account > Security > Passkey > Create Passkey. Confirm with your phone's biometrics or Windows Hello / Touch ID . Then enable Two-Step Verification and add at least one backup method (one-time password or hardware key).
On Apple ID , go to Settings (iPhone/iPad) > Name > Password & Security > Add Passkey. Passkeys sync via iCloud Keychain . Also enable Two-Factor Authentication for your Apple ID to protect iCloud, Mail, and the App Store. On Microsoft Account : Security > Advanced Options > Passkey > Set Up, then enable Two-Factor Authentication and connect the Microsoft Authenticator app or a FIDO2 security key .
2FA on social media: Instagram, X, Facebook, and WhatsApp
Social media and messaging are frequent targets for scams and takeovers. On Instagram , open Settings & Privacy > Account Center > Password & Security > Two-Factor Authentication and choose Authentication App or WhatsApp as the OTP channel; avoid SMS if possible. On Facebook (Settings > Security & Login > 2FA), prefer an OTP app or a FIDO-compatible security key.
On X (formerly Twitter), go to Settings & Privacy > Security & Login > Two-Factor Authentication and enable Authentication App or Security Key . On WhatsApp, enable Two-Step Verification in Settings > Account > Two-Step Verification: Set a PIN and Recovery Email. This PIN is required when reinstalling and reduces the risk of SIM swaps and account hijacking.
Banking and Payments: Apps, SCA, and OTP
Institutions are adopting Strong Customer Authentication (SCA) with biometrics and push notifications. Many banking apps offer built-in protection: enable Face ID/Touch ID or Android fingerprint and set a strong passcode. On PayPal , open Settings > Security: enable Passkey if available and two-step verification with an in-app OTP or hardware key. On services like Revolut or N26, enable biometrics and push approval ; check the Security section to enable recovery codes or emergency numbers.
For traditional online banking, if available, choose FIDO2 hardware keys or OTP apps over SMS. Always update your phone number and email address in your account details: in SCA procedures, they often serve as secondary contact channels in the event of a block.
Secure backup: recovery codes, offline copies and management
After activation, generate recovery codes where available (Google, Facebook, X, PayPal). Save them outside of your email. Best practices: 1) Store in a password manager with an encrypted vault; 2) Paper copy in a sealed envelope; 3) Copy to an encrypted USB drive stored elsewhere. Do not save codes in unprotected notes or unencrypted cloud storage; avoid screenshots in your camera roll.
For hardware keys , get two: a primary one and a backup one stored separately. Label them anonymously (e.g., “U2F-01”) and register both to your accounts. For OTP apps , choose solutions with encrypted backup and secure synchronization between devices; if these features aren't available, store the seed codes (secret QR codes) offline and securely.
Multi-device management: synchronization and migration
Passkeys sync across the ecosystem: iCloud on Apple devices, Google Password Manager on Android/Chrome, and Windows/Edge with a Microsoft account. To add a new device, log in to your primary account and authorize the copy of the biometric or passkey from the old device. In mixed environments, consider a FIDO2/NFC hardware key as a universal bridge between laptop and smartphone.
To migrate an app OTP , use the built-in secure export (e.g., transferring with a local QR code). If unavailable, disable 2FA on each service and re-enable it by scanning the new QR codes from the target device. Proceed in an orderly fashion: one service at a time, with the administrator session open and recovery codes ready to avoid lockouts.
OTP app, hardware keys, or push notifications? The essential comparison.
OTP apps : Pros — simple, offline, and inexpensive; Cons — vulnerable to targeted phishing and code injection on fake websites. Hardware keys (FIDO2/U2F): Pros — maximum phishing resistance, enterprise support, works via USB/NFC; Cons — cost, physical management, requires a second backup key. Push notifications : Pros — immediate and convenient; Cons — risk of push bombing and incorrect approvals under pressure. SMS is the last resort: useful as a backup method , but vulnerable to SIM swaps and interceptions.
A balanced strategy for critical accounts: passkey as the primary login, a registered backup hardware key, an OTP app as an additional fallback, and recovery codes printed offline. Verify active methods every quarter, remove obsolete numbers, and update the trusted device before selling or resetting old devices: reduce friction when traveling, changing smartphones, and when customer support requests additional proof of identity.