Two-factor in 10 minutes: what to turn on first
A stolen password is no longer enough to get in. Email, the bank and your website hosting come before everything else. The order and the method we recommend.
Two-factor (also called two-step authentication or MFA) asks for a second proof as well as your password: a code in an app, a notification on your phone or a physical key. If someone steals the password, they're left at the door.
The right order
- 01 The company email (Microsoft 365 or Google Workspace). Whoever controls the email can click “I forgot my password” on almost every other service.
- 02 The bank and payment platforms.
- 03 The domain and website hosting: whoever gets in here can redirect the email and the entire website.
- 04 Accounting and the government platforms the company uses.
- 05 The company's social media and work tools (invoicing, CRM, online shops).
Which method to choose
- Best: a physical key (USB or NFC) or a passkey. There's no code for anyone to ask you for.
- Very good: an authenticator app (Microsoft Authenticator, Google Authenticator or similar).
- Acceptable: text message. It's better than nothing, but a scammer can get the number transferred.
Don't forget the emergency exit
When you turn it on, most services give you recovery codes. Print them or keep them in a password manager, never in a file on your desktop. If you lose your phone, they're what lets you back in.