How to add MFA to your important accounts

To add MFA, start with the accounts that would hurt most if stolen: email, banking, password manager, cloud storage, work tools, social accounts, and shopping accounts with saved payment details. Turn on the strongest available method, save recovery codes somewhere safe, and test sign-in before you log out of every device.

Account protection in one pass

Multi-factor authentication, or MFA, asks for more than a password when you sign in. CISA defines it as a layered approach requiring two or more credentials and states on its MFA guidance page that MFA makes accounts much less likely to be hacked. The basic idea is simple: a stolen password should not be enough.

Common factors include something you know, such as a password; something you have, such as a phone, authenticator app, or hardware key; and something you are, such as a fingerprint or face check on your own device.

Choose the right MFA method

Not every MFA method is equal. SMS text codes are better than no MFA, but they can be vulnerable to SIM swap and interception. Authenticator apps are usually stronger because codes are generated on your device. Push approvals are convenient, but you must watch for fatigue attacks where a criminal sends repeated prompts. Hardware security keys and passkeys can offer stronger phishing resistance when supported.

NIST's Digital Identity Guidelines provide technical requirements for authentication and identity systems, but everyday users can apply the plain-English lesson: prefer phishing-resistant options for your most important accounts when they are available.

Step 1: secure your email first

Your email account is the reset key for many other accounts. If someone controls your email, they can reset passwords elsewhere. Start there. Open account security settings, find two-step verification or multi-factor authentication, choose an authenticator app or passkey if offered, and add a backup method.

After setup, look for recovery options. Confirm that your recovery email and phone number are yours. Remove old devices and sessions you do not recognize. If your email account supports recovery codes, download or print them and store them securely.

Step 2: protect financial and identity accounts

Next, add MFA to banking, credit card, tax, payroll, retirement, insurance, and government accounts. These accounts may offer fewer choices than major email providers, but enable the best available method. If SMS is the only option, use it rather than leaving the account password-only.

Never share MFA codes with anyone who calls, texts, or emails you. Real support teams should not need your one-time code. If a prompt appears that you did not start, deny it and change your password from a trusted device.

Step 3: add MFA to password managers and cloud storage

A password manager holds keys to other accounts, so it deserves strong protection. Use an authenticator app, hardware key, or passkey when supported. Save emergency access instructions according to the password manager's official guidance.

Cloud storage is also high value because it may contain IDs, contracts, photos, business files, school documents, and backups. If your cloud account is tied to a phone or laptop, make sure device screen locks are enabled too.

Step 4: cover social, shopping, and work accounts

Social accounts can be used for scams, impersonation, and password resets. Shopping accounts may store payment methods and addresses. Work accounts may expose client data, internal files, or email. Add MFA to each one, then review connected apps and old devices.

If you work remotely or use shared networks, combine MFA with safer home networking habits. The article on remote work mistakes explains why account security, device hygiene, and communication habits all support online trust.

Step 5: create a recovery plan

MFA can lock out the rightful owner if recovery is sloppy. Save backup codes offline. Add more than one trusted method when possible. Keep your authenticator app backed up according to the provider's official instructions. For hardware keys, register two keys when possible and store the spare separately.

Do not keep recovery codes only inside the account they protect. If you save email recovery codes in that same email account, they may not help when locked out. A printed copy in a secure location or an encrypted password manager note can be safer.

Common setup mistakes

• Turning on MFA without saving recovery codes.
• Using the same weak password and assuming MFA solves everything.
• Approving push notifications you did not start.
• Leaving old recovery phone numbers or email addresses attached.
• Using SMS for every account even when app, passkey, or hardware key options exist.
• Forgetting work policies before changing business account settings.

What to do if you lose your phone

Use your backup codes, backup authenticator, spare hardware key, or recovery email. If none works, follow the official account recovery process. Be patient and avoid third-party “account recovery” services that ask for passwords, codes, or payment.

Once back in, remove the lost device from trusted devices, change your password, review recent activity, and set up a stronger backup path. If the lost phone may be stolen, use the device maker's official lost-device tools.

Make MFA a normal habit

Add MFA when you create an account, not after a scare. Start with email, banking, password manager, cloud storage, and work accounts. Then move through social, shopping, and subscription services. For spreadsheet-based account inventories, spreadsheet basics can help you track which accounts still need protection without storing passwords in plain text.

Your security finish line

You are in good shape when your highest-value accounts have MFA, recovery codes are stored safely, old sessions are removed, and you know what to do if your phone is lost. That is a practical, repeatable account security system.