Setting Up Two-Factor Authentication: Best Practices Guide

Last month a client called me in a panic: locked out of his Google Workspace, locked out of his bank, and his only recovery option was a phone number he'd cancelled two years earlier. He had set up two-factor authentication on all of it—years ago. The problem wasn't that 2FA failed. It was that he'd configured it once, then never touched it again.

That's the trap. Most people treat two-factor authentication as a checkbox: enable it, forget it, move on. But a 2FA setup that ages badly is barely better than no 2FA at all. Below is what I've learned setting up MFA best practices across dozens of accounts, several small businesses, and one very stubborn family member who still refuses to use an authenticator app.

Why most two-factor authentication setups quietly fail

The setup step isn't where people go wrong. The after is.

I've audited maybe forty personal and small-business accounts over the past few years, and the pattern repeats: someone enables 2FA during a security scare, feels good about it, and never thinks about it again. Six months later, they've changed phones, dropped a number, or installed a new authenticator without migrating the old one. Then something needs to log in at 11 p.m. on a Sunday.

Here's the thing: two-factor authentication protects against a stolen password, but it creates a new dependency—your second factor has to be reachable when you need it. That dependency is where the failures live. A properly maintained setup accounts for three realities most guides skip:

• Your phone will eventually be lost, stolen, or wiped
• You'll change carriers, or drop a number you forgot was tied to an account
• You will one day try to log in somewhere with no signal and no laptop

Everything below is designed around those three. Not around the initial "click enable" moment.

Picking the right factor, not the most convenient one

SMS codes are the default because they're easy. They're also the weakest option in the room. SIM-swap attacks are a well-established technique, and once someone controls your number, your SMS codes are theirs. That doesn't make SMS useless—it makes it a fallback, not a foundation.

Method	Phishing resistance	Setup effort	Best for
SMS / voice codes	Low	Minimal	Low-value accounts, last-resort fallback
Authenticator app (TOTP)	Medium	Low	Most everyday accounts
Push notification	Medium	Low	Work accounts with number matching enabled
Hardware security key (FIDO2)	High	Moderate	Email, banking, admin accounts
Passkeys	High	Moderate	Anywhere the platform supports them

My own rule: if an account could be used to reset other accounts, it gets a hardware key or a passkey. That means your primary email, above all. Your email is the master key to everything else—banking, social, work. If someone gets into your inbox, they can often reset the rest without ever touching your 2FA on those other services.

The actual setup, in order

Enable 2FA on your primary email first. Not your bank, not your social media—your email. If that's compromised, everything downstream is compromised anyway.

Enrollment order that saves hours later

1. Turn on 2FA for your main email account and choose the strongest factor it supports.
2. Generate recovery codes immediately, before you close the settings page.
3. Add a second factor as backup—a different app, a different device, or a security key you keep somewhere else.
4. Repeat for financial accounts, then work accounts, then everything else by value.
5. Test each one by logging out and back in while you still remember what you did.

That last step is the one people skip, and it's the one that catches problems early. I once enrolled a hardware key, felt confident, and discovered three weeks later that I'd never actually confirmed it worked on the login page—it had registered but wasn't the primary method. Twenty minutes of confusion I could have avoided with a two-minute test.

Recovery codes: the part everyone botches

Recovery codes are single-use backup codes that let you get back in when your second factor is gone. They are the safety net under the safety net. And almost nobody stores them properly.

Here's what works: print them, or write them down, and store them in two physically separate places. One at home, one somewhere else you trust. Not in your password manager alone—if you lose access to the manager, you lose the codes too. Not in a screenshot on your phone, because that's the device you're probably recovering from.

When I set this up for my parents, I wrote their codes on paper and put one copy in a fireproof box and one in a sealed envelope with a relative. Overkill? Maybe. But when my mother's phone died last year, she was back into her accounts in four minutes instead of four days.

MFA prompt frequency best practices

Push notifications have a dirty secret: if you get too many, you start approving them without reading. That's not a user flaw—it's a design trap, and attackers know it. Fatigue attacks work by spamming approval prompts until someone taps "yes" out of habit.

So the setting matters. Where the platform lets you control it:

• Set prompts to fire only when the sign-in is genuinely risk-elevated—new device, new location, unfamiliar network.
• Enable number matching if the service offers it. The push shows a number, and you type it into the login page. A blind "approve" tap can't complete the login.
• Turn off prompts on trusted personal devices you use daily, or the noise will train you to ignore them.
• If a prompt arrives when you didn't try to log in, deny it—and then change your password, because someone has it.

That last point is the one I can't stress enough. An unexpected prompt isn't a glitch. It means someone has your password and is actively trying to get past your second factor. Deny, then act.

Setting up two-factor authentication on Android and iOS

The mobile setup is where most people actually do this for the first time, so a few platform-specific notes.

On Android

Google's own account 2FA lives in your Google Account settings, and if you use an Android phone, you already have a built-in second factor: the prompt on your device. That's convenient—maybe too convenient. I'd still recommend pairing it with an authenticator app, because a device prompt only works when the device is with you and unlocked.

For third-party sites, install an authenticator app from the Play Store, and check whether it supports encrypted cloud backup. Not all do, and that difference matters enormously when you switch phones.

On iOS

iOS has a built-in password manager and code generator under Settings, which handles most TOTP codes without a third-party app. If you use iCloud Keychain, these sync across your Apple devices automatically, which solves the "lost phone" problem if you're all-in on Apple hardware. If you're not, keep a separate authenticator app and back it up.

One gotcha on both platforms: if you rely on your phone as your only second factor, you've built a single point of failure. Add a hardware key or a second device as backup before you need it.

When you're locked out: a recovery plan that actually works

Recovery codes are the first move. If those are gone too, the plan depends on the account:

• Personal accounts: use account recovery flows (backup email, trusted contacts, identity verification). These can take days, so start immediately rather than hoping the problem resolves.
• Work accounts: go through your IT helpdesk, not the self-service flow. Admins can reset MFA enrollment, but they'll want proof you're you—expect a video call or in-person check.
• Financial accounts: call the institution directly and be ready to verify identity through multiple channels. This is slow on purpose.

The best recovery plan is the one you never need. Which is why the annual review matters: every year, log into your security settings and check which devices and factors are enrolled. Remove the old phone. Remove the number you don't have anymore. Confirm your recovery email still works. It takes fifteen minutes and prevents the exact scenario that had my client calling me at midnight.

A quick note on shared and family accounts

If multiple people need access to one account, don't share a single 2FA method. Use the platform's delegation or shared-access feature if it has one, or enroll each person's own factor separately. Sharing a code by text message defeats the entire point—and it's how a lot of small-business account compromises start.

Two-factor authentication isn't a setting you turn on. It's a small system with moving parts: a primary factor, a backup, recovery codes in two places, and a yearly check that all of it still lines up with the phone in your pocket. Set it up once properly and you'll forget it exists—which is exactly the point.