Enable multi-factor authentication on important accounts, preferring a supported phishing-resistant method where practical. Start with email, your password manager, financial services and accounts that control other accounts. Set up recovery before you depend on a single phone or key.
Two-factor authentication uses two different kinds of proof, such as a password and a device. Two passwords or a password followed by another knowledge question are not the same thing.
Choose the method the account actually supports
The Australian Government’s MFA implementation guidance favours phishing-resistant authentication. Passkeys and compatible security keys can use public-key methods tied to the intended service, reducing the opportunity to relay a code through a fake login page.
An authenticator app’s changing code is useful, but a convincing phishing site can still ask you to enter it. SMS also adds protection over a password alone, while introducing weaknesses such as attacks on the phone-number account. Use the strongest supported option you can reliably manage rather than abandoning MFA because the ideal method is unavailable.
Passkeys are not simply another six-digit code
A passkey can replace the account password rather than always appearing as an extra step. How it is stored, synced and unlocked matters. Government system-access guidance explains that its single-factor or multi-factor status depends on implementation, including whether activating the private key requires a password or biometric.
Check the provider’s instructions for your devices. A fingerprint unlocking a passkey is different from sending your fingerprint to every website. Avoid assuming all products with a similar login screen have identical recovery arrangements.
Prepare for losing or replacing a device
Where offered, save recovery codes somewhere protected and accessible without the account they recover. If they are single-use, replace the set after use according to the provider’s instructions.
Register an additional supported recovery method or spare key when appropriate. Before wiping an old phone, confirm that you can sign in using the replacement and that any authenticator accounts have transferred correctly. Recovery procedures differ between services; do not assume reinstalling an app restores every secret.
Treat unexpected prompts as a warning
Do not approve a login request you did not initiate. Repeated prompts are not a reason to tap yes to make them stop. Open the service through a known route, inspect its security activity and change compromised credentials as appropriate.
MFA does not repair an infected device or guarantee protection against stolen active sessions. Keep devices updated, use unique passwords where passwords remain necessary, and review logged-in devices after suspicious activity. Our device-care and recovery guide covers supported updates, backups and hardware checks alongside account security.
Make it sustainable
Use the account’s own security settings to see which methods are registered and remove obsolete devices after confirming replacements work. Record how recovery works for the small number of accounts whose loss would cause the most disruption.
A remembered-device option reduces prompts; it does not make a shared computer safe. Good setup combines stronger authentication with a recovery route you have checked before an emergency.
Zachary Skinner is the editor of TechDrivePlay.com, where tech, cars and adventure share the fast lane.
A former snowboarding pro and programmer, he brings both creative flair and technical know-how to his reviews. From high-performance cars to clever gadgets, he explores how innovation shapes the way we move, connect and live.
