1. SMS: familiar, but tied to a phone number
With a typical SMS method, you enter a delivered code after your password. This can add protection compared with a password alone. It depends on access to your phone number, however; changing or losing control of that number can cause problems. Fake pages can also ask for the codes. Do not share them with a caller or someone in a chat. Receiving a genuine security message does not prove that the page you used immediately before it was genuine.
2. App codes: no SMS, but still vulnerable to deception
After setup, an authenticator app generates changing codes; many common methods work without mobile reception. This removes dependence on SMS delivery. It does not make the code immune to phishing: someone can try to capture it while it remains valid. Before changing phones, check how your particular app transfers or recovers its entries. Not every app and configuration synchronises automatically. Protect setup information and recovery options so they cannot become another route into the account.
3. Approval prompts: approve only your own action
Some services send an approval request to a device that is already signed in. Read what it describes and approve only a sign-in you started on the genuine service. Reject repeated unexpected prompts rather than accepting one because you are tired of them. Then open the security settings yourself and investigate. A roughly familiar location alone does not establish that the attempt is legitimate. A prompt on your real phone can still relate to a process started by somebody else.
4. Passkeys: a login bound to the genuine service
A passkey uses a cryptographic key bound to the genuine service. You approve its use with, for example, your device lock, a PIN or biometrics. This prevents the familiar capture of a reusable password or code on a fake page. A passkey is not simply another password you dictate to someone. Your device, synchronisation account and recovery process still need protection. Passkeys cannot prevent every scam or stop a payment that someone persuades you to authorise yourself.
5. Choose and test with device loss in mind
In this fictional example, Sara enables a passkey at her supported email service and checks its intended backup route. Another service offers only additional codes, so she sets up an appropriate available method there. She privately records how to regain access if her phone is lost, without leaving secrets exposed. A compatible hardware security key can provide another option, but buying one is not compulsory for every account. Remove existing working alternatives only after checking the new setup.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Do multiple factors always require two devices?
No. Multiple factors do not have to live on separate devices. A passkey can combine possession of the key with user verification, such as unlocking a device. The steps a service asks for depend on its implementation. Follow its official instructions.
Should I switch off SMS protection because it is imperfect?
Do not remove it without a replacement. First check better supported options and complete their setup. An additional SMS step can still improve protection compared with a password alone. Keep your phone number current and do not give codes to other people or unfamiliar pages.
Do I definitely need a smartphone for additional account protection?
Not for every service. A passkey on your own computer or a compatible hardware security key may be available, depending on the provider. Check supported methods and recovery. Do not buy hardware based only on general advice before confirming compatibility.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- NCSC: Passkeys are more secure than traditional ways to log in — 23 April 2026Source review date:
- NCSC: Turn on 2-step verificationSource review date:
- Google Account Help: Turn on 2-Step VerificationSource review date:
