Contents
In short
Turn on MFA or passkeys first for email, your Apple/Google/Microsoft account, banking and social media. It costs nothing and is the single most effective step for accounts.
What is it?
With multi-factor authentication (MFA) you need a second proof besides your password, such as a code from an app. A passkey replaces the password with a cryptographic key on your device that you unlock with fingerprint, face or PIN.
Who is it useful for?
Everyone. Especially important for your email account, because other passwords are reset through it.
What does it protect against?
- Account takeover with a stolen or leaked password
- Passkeys additionally: phishing, because they only work on the genuine website
What does it not protect against?
- Codes you hand over yourself on the phone or on a fake site (SMS and app codes)
- An unlocked stolen device without screen lock
- Missing recovery options when a device is lost
What you can do for free
- 01Turn on MFA in the security settings of key services
- 02Create passkeys wherever they are offered
- 03Print recovery codes or store them in your password manager
When is an extra product worth it?
There are usually no extra costs. A hardware security key can complement especially important accounts.
What to check when choosing
- Prefer a passkey or authenticator app; SMS is better than nothing
- Register at least two sign-in methods
- Test the recovery route before you need it
We deliberately name no products and publish no rankings.
Common mistakes
- Giving MFA codes to supposed support staff on request
- Approving push prompts you did not trigger
- Registering only one device as second factor
Checklist
- Email account protected with MFA or a passkey
- Banking, cloud and social media protected
- Recovery codes stored safely
- I only approve prompts I triggered myself
Frequently asked questions
What happens to passkeys if I lose my phone?
Passkeys usually sync through your platform account. Without sync you need a second sign-in method or recovery codes.
Is SMS as a second factor unsafe?
SMS is weaker than an app or passkey, but protects far better than a password alone.
Sources
Checked on 6 Oct 2026.