TL;DR: A long random password stops guessing. A second factor stops someone who already stole or phished that password. They answer different failures, so you want both on mail, banking, and the password manager. Prefer an app or a hardware key over SMS when the site allows it. Turn on the second step after the new password is saved, not instead of changing a weak one. When the site demands a fresh secret, generate it first so the factor is not guarding a reused string.
The payroll phish that had the right password
A school bookkeeper received a message that looked like the district’s payroll vendor. The link was wrong by one letter. She typed the real password, which was long and unique, into the fake page. The attacker used it within minutes. What stopped the wire was a prompt on her phone from an authenticator app she had enabled the previous spring. She denied the prompt. The vendor’s fraud desk still had a messy morning, but the transfer did not go out. The password had done nothing wrong. It had been handed over. The second factor was the part that noticed.
People describe this as “2FA saved me,” which is true and incomplete. If she had reused that password everywhere, the attacker would have tried it on webmail next, and some of those sites would not have prompted. The pair is the control. Either half alone leaves a familiar hole.
What the second step actually checks
A password proves you know a secret that can be copied. A second factor should prove something that is harder to copy in the same moment: a code from an app on your phone, a hardware key sitting on the desk, or a push you must approve. SMS codes are better than nothing and weaker than the others, because phone numbers can be moved by a persuasive call to a carrier. Use SMS if it is the only option. Move to an app or a key when the account allows it.
- Authenticator app: codes stay on the device and work on a plane.
- Hardware key: best for mail and the password manager if you will carry it.
- Push prompt: fine until fatigue trains you to tap approve without reading.
- SMS: acceptable as a bridge, poor as the long-term plan for mail.
- Backup codes: print them once and store them with the paper copy of your master password, not in the email inbox.
Order matters when you enroll
Change the password first, confirm you can sign in, and save it in the manager. Then enroll the second factor. If you flip the order, a failed enrollment can leave you locked out while the password is also mid-change. During enrollment the site shows backup codes or a QR code. Treat the QR photo as a secret. A picture of it in a camera roll that syncs to a shared family album is a second copy of the factor, sitting where you did not intend.
Recovery email and recovery phone number are part of the same door. If those point at an inbox you never check, or a number you no longer own, the attacker does not need your authenticator. They reset the account. Update recovery details on the same afternoon you enable the factor.
Prompt fatigue is a real setting
Some attacks spam push notifications until the victim taps through. Read the prompt. If you did not just try to sign in, deny it and change the password anyway, because the prompt means someone has the secret. This is also why a random unique password still matters: fewer people have it, so fewer prompts arrive.
Where people skip the second step
They put 2FA on banking because the bank nagged them, and they leave webmail on password only. Mail is the reset channel for the bank. They protect a social network and leave the domain registrar open. The registrar can rewrite where the website points. Match the factor to the accounts that can impersonate you or move money, not to the ones with the scariest logo.
Work accounts sometimes forbid personal authenticators and issue their own. Use theirs. Do not “also” store the work password in a personal notes app because the SSO flow feels slow. The second factor at work does not protect a copy you pasted somewhere else.
Turn it on for the three accounts that reset the others
This week, confirm the mailbox, the password manager, and the phone-carrier login each have a second factor that is not only SMS if you can avoid it. Generate a new password for any of the three that is still shared or short, save it, then enroll. Keep the backup codes somewhere you can reach if the phone is in a lake. The bookkeeper’s prompt was annoying for one second and decisive for the rest of the day.