Turn On Multifactor Authentication and Check the Recovery Route

Multifactor authentication adds an identity check beyond a password. Begin with an important account such as your primary email, because access to it may also be used to recover other accounts.

Open security settings directly

Use the service's official app or a known website address. Find its security or sign-in settings and read the available methods. CISA recommends the strongest suitable option available, including phishing-resistant methods where supported. The names and setup sequence vary by service.

Do not follow an unexpected message asking you to disable protection or approve a login you did not initiate. A second factor helps protect access, but it does not make every message or login request trustworthy.

Complete setup while you still have access

Follow the service's own instructions and complete the requested confirmation. If it supplies recovery codes, store them in a private, secure place separate from an easily lost device. Do not paste them into support chats or share them with someone claiming to help set up the account.

Read what happens if your phone, security key, or other sign-in method is lost. If a backup method is supported, consider setting it up using the service's guidance. Keep recovery contact details accurate without making them public.

Verify, then document the method

After setup, confirm the security page shows the method as enabled. When practical, test a normal sign-in in another session while retaining your original session. Record the method and where recovery instructions are stored, rather than recording secret codes in a general checklist.

Before replacing a device, revisit those instructions. Moving an app icon or restoring a phone backup does not necessarily transfer every authentication credential. The completed task is an account you can securely access and recover, with the recovery process understood before you need it.