Dorothy Harris is 71 years old and lives in Decatur, Georgia. Last year, she woke up to an email from Google telling her that someone in Eastern Europe had logged into her Gmail account. Everything she had stored there, 12 years of emails, family photos sent from her daughter in Lagos, the account she used to pay her electric bill, was suddenly at risk. The person who got in had her password. What they did not have, and what would have stopped them entirely, was a second form of verification that only Dorothy could provide.
Dorothy did not have that set up. Many people do not.
This guide is for Dorothy, and for everyone like her. It explains what two-factor authentication is, how to turn it on in about five minutes, and how to make sure you are never locked out if something goes wrong. You do not need to be a tech person. You just need a phone.
What Two-Factor Authentication Actually Is
Two-factor authentication, or 2FA, adds a second lock on your accounts so that even if someone steals your password, they still cannot get in without a second piece of proof that only you have. Your password is the first factor. A short code sent to your phone, or generated by an app, is the second.
Think of it like your front door. Your password is the key. Two-factor authentication is the deadbolt. Even if someone copies your key, the deadbolt keeps them out.
Security experts group the second step into three categories: something you know, like a password or PIN; something you have, like your phone, a security key, or a code generator; and something you are, like your fingerprint or your face. Most people use the “something you have” method: a 6-digit code sent by text or generated by an app, entered right after the password. The whole process adds about ten seconds to logging in.
Why This Matters Right Now
Two-factor authentication is not a theoretical upgrade. It is a response to what is already happening every day.
In 2024, Americans over 60 reported nearly $5 billion in losses to cybercrime, according to the FBI’s Internet Crime Complaint Center. The FTC has documented a more than four-fold increase in reports of impersonation scammers stealing large sums from older adults since 2020, with losses of $100,000 or more rising eight-fold in that period. One recent analysis found that most older adults have either been targeted themselves or know someone who lost money to an online scam.
Most of these attacks begin with a stolen or guessed password. Two-factor authentication does not prevent a password from being stolen. What it does is make a stolen password far less useful to whoever has it. That matters especially as digital payments in Africa and globally continue to grow, putting more of our financial lives online and within reach of anyone who can access an account.
SMS Code vs. Authenticator App: Which Should You Use?
When you turn on 2FA, you usually see two main choices. Here is what they mean in plain language.
| Method | How it works | Pros | Cons |
|---|---|---|---|
| Text message (SMS) | A 6-digit code is sent to your phone by text | Very easy to set up, no extra app needed | Can be intercepted; depends on phone signal and phone number safety |
| Authenticator app | An app on your phone generates a new code every 30 seconds | Works without cell service; codes never travel over the network | Requires installing and learning one new app |
Security researchers and major providers consider authenticator apps safer than text messages because the codes are created right on your phone and do not travel over the phone network, which can be targeted through SIM swapping and similar attacks. That said, text-message 2FA is still far better than no 2FA at all, so it is a perfectly fine place to start.
Free authenticator apps that work on both iPhone and Android in 2026:
- Google Authenticator: Simple, widely supported, and now syncs your codes to your Google account so switching phones is easier than it used to be.
- Microsoft Authenticator: Integrates well with Microsoft 365, Outlook, Teams, and most other services. Hides your codes by default, which is a smart security touch.
- 2FAS: Open-source, privacy-focused, and praised for its clean interface. Backs up to iCloud or Google Drive depending on your phone.
- Ente Auth: End-to-end encrypted backups and cross-platform access. A strong pick if privacy is a priority for you.
How to Turn On 2FA for Your Apple ID (iPhone)
Your Apple ID controls access to your iCloud photos, iMessage, App Store purchases, and in many cases your payment details. Securing it is a high-impact five-minute job.
- Open the Settings app.
- Tap your name at the top of the screen.
- Tap Sign-In and Security (some iOS versions show this as Password and Security).
- Tap Two-Factor Authentication.
- Tap Turn On Two-Factor Authentication, then tap Continue.
- Enter your trusted phone number. This is where Apple will send your codes.
- Choose whether to receive codes by text message or phone call, then tap Next.
- Enter the 6-digit code Apple sends to that number to confirm everything works.
Once this is done, your iPhone becomes a trusted device. When anyone, including you, tries to sign in to your Apple ID on a new device, Apple sends a code to your trusted number or shows a prompt on your trusted devices. Without that second step, the sign-in fails.
One important note: once you turn on 2FA for your Apple ID, you cannot turn it off. Apple made this permanent to protect accounts that have already been secured.
How to Turn On 2FA for Your Google Account (Android or Any Phone)
Your Google account connects Gmail, Google Photos, your Android backup, and more. Turning on 2-Step Verification works from any phone or computer.
- Go to myaccount.google.com in a browser, or open Settings on your Android phone and tap Google, then Manage your Google Account.
- Tap the Security tab.
- Under “How you sign in to Google,” tap 2-Step Verification.
- Tap Get started and sign in again if Google asks.
- Choose your preferred second step: a Google Prompt sent to your phone, a text message or voice call, or an authenticator app.
- Follow the on-screen instructions to confirm it works.
- When Google offers backup options like backup codes or a secondary device, take a moment to set those up too.
After setup, you will only see the second step when you sign in on a new device or when Google detects something unusual about the login attempt.
How to Set Up an Authenticator App (Works on Both iPhone and Android)
Authenticator apps follow the same basic pattern no matter which service you are protecting. This process works for Gmail, Facebook, Instagram, your bank app, or almost anything else that supports 2FA.
- Install one of the authenticator apps listed above from the App Store or Play Store.
- On the service you want to protect, go to Settings, then Security, and look for Two-Factor Authentication, 2-Step Verification, or Login Security.
- When you see options, choose Authenticator app.
- A QR code will appear on the screen.
- Open the authenticator app, tap the Add or + button, and choose Scan QR code. Point your phone’s camera at the QR code.
- The app will start showing a 6-digit code for that account. Enter that code back on the website or app to confirm the setup is complete.
From that point on, logging in means entering your password, opening the authenticator app, reading the current code for that account, and typing it in before it expires. These codes change every 30 seconds, which is what makes them so difficult for attackers to reuse.
Do Not Skip Backup Codes
When you turn on 2FA, most services offer backup codes. These are one-time passwords you can use if you lose your phone or cannot reach your usual code.
This step matters because phones get lost, stolen, or replaced. Without a backup method, you can lock yourself out of your own account permanently.
Good places to store backup codes:
- Printed on paper and stored with other important documents
- In a trusted password manager behind a strong master password
- In a home safe or a folder where you keep legal and financial papers
If you are ever locked out and see a link that says “Try another way” or “Use backup code,” that is where you enter one of these stored codes. After you regain access, generate a fresh set of backup codes immediately. Each code is single-use, so a spent set offers no protection.
One Mistake to Avoid
If a 2FA approval request arrives on your phone and you did not just try to log in anywhere, tap Deny immediately. Then change your password for that account right after. Someone has your password and is hoping you approve their login out of habit or confusion. Security researchers call this an MFA fatigue attack, and it works more often than it should.
Real 2FA prompts only appear when you are actively logging in. If one shows up on its own, treat it as a warning, not a routine notification.
This Is Not Complicated. It Just Feels New.
If none of this was part of how you grew up using technology, that is completely normal. Two-factor authentication only became common and easy to set up in recent years. The steps above are written so that a teenager and a grandparent can follow them side by side without needing a tech dictionary.
Start with the one account that matters most. For most people, that is email, because almost every other account can be reset through it. Once email is protected, move to your Apple ID or Google account, then to banking and shopping accounts.
Dorothy Harris did turn on two-factor authentication after her scare. She chose the text-message option because it felt familiar. “It just sends me a number,” she said. “I type it in. That is it.” Her Gmail has stayed hers ever since.
Quick Recap
- Pick one authenticator app and install it first.
- Turn on 2FA for your Google or Apple account.
- Work through email, banking, and social media next.
- Save your backup codes somewhere you will not lose them.
- Never approve a 2FA request you did not start yourself.
Two-factor authentication is one of the most effective single changes you can make to protect your digital life. It is free, it works on any modern phone, and once you have used it a few times it will feel as routine as locking your front door. For a broader look at what else you can do to protect your accounts and devices, the TechCity complete online security checklist is a practical next step.
Dorothy Harris is a composite character based on the reported experiences of real cybercrime victims. Her story reflects documented fraud patterns affecting older adults in the United States.