Two-factor authentication (2FA, sometimes called multi-factor or MFA) asks for something extra after your password: a code, a tap on your phone, or a security key. A criminal who has your password still can’t get in.
Which kind to use
From strongest to weakest:
- Passkeys or security keys. They can’t be phished, because they only work on the real website. Use them wherever they’re offered.
- An authenticator app (Google Authenticator, Microsoft Authenticator, or the one built into your password manager). A six-digit code that changes every 30 seconds.
- SMS codes. The weakest option, because phone numbers can be hijacked through a SIM swap. Still far better than nothing.
Turn it on in this order
- Your main email account
- myGov and your bank (most Australian banks now require it)
- Your Apple or Google account, which controls your phone
- Social media accounts, which are often taken over and used to scam your friends
Save your backup codes
When you turn on 2FA you’ll usually get a set of one-time backup codes. Store them in your password manager, or print them and keep them somewhere safe. They’re how you get back in if you lose your phone.
Never read a code out to anyone. Your bank, the ATO and tech support will never ask for one. Anyone who does is trying to sign in as you.
Completed