Two-factor authentication: the safeguard that works even if someone steals your password

Q: I received a verification code even though I'm not logging in. What does it mean?

It most likely means that someone knows your password and is trying to log in right now – and the second step has stopped them. Don't enter the code anywhere. As soon as possible, change your password for that service (and wherever you use the same one). You can tell whether such a message can be trusted with the help of our article on scam messages .

Q: I don't have a smartphone. Can I have two-factor authentication?

Yes. If you don't have a smartphone for an app, use an SMS code on an ordinary phone, or for important accounts a physical key that plugs into a computer. There's almost always an option.

Security

9. 9. 2026

Two-factor authentication is an extra step on top of your password – most often a code from an app or an SMS. Thanks to it, nobody can get into your account, even if they knew your password. It is one of the most effective and at the same time simplest protections you can set up, and turning it on takes a few minutes. In this article, we'll show you how to do it without worry – including what to do if you lose your phone.

In short: turn on two-factor authentication wherever you can, and start with your e-mail. As the second step, the most sensible choice is an authenticator app on your phone; if SMS suits you better, turn on SMS – even that is much better than nothing. And right at the start, save your backup codes in case you lose your phone.

Why a password alone isn't enough

Even the best password has one weakness: all it takes is for it to get into the wrong hands – and it's useless. And this can happen in two ways that aren't your fault. Either you accidentally enter it on a fraudulent website that looks like the real one, or it leaks from some breached service where you used it.

A strong and unique password is still the foundation – we explain how to create one in our article on secure passwords. But even a perfect password only solves half of the problem. The other half is solved by two-factor authentication. It isn't a replacement for a good password – it's a second layer that kicks in exactly when the first one fails.

A password alone is enough for an attacker; a password with a second step isn't.

The point is simple: a password is something you know, and the second step is something you have – your phone or a key. An attacker on the other side of the world may know your password, but they don't have the phone in your pocket. And without it, they can't log in.

What happens if your password does leak

Let's imagine the worst case: your password has got out. Without a second step, the attacker would have won – they would log in and be inside. With two-factor authentication, however, they hit a wall at the very first step after entering the password:

Even if the password leaks, the second step stops the attacker.

This is exactly what happens in practice. If you suddenly receive a verification code even though you aren't logging in yourself, it's usually a sign that someone is trying your password – and that the second step has stopped them. Don't enter such a code anywhere, and change your password at the earliest opportunity.

Three ways to do the second step

You can do the second step in three ways. They differ in how secure and convenient they are – but all three are significantly better than none. Don't be put off by the fact that one of them isn't “perfect”.

All three methods are better than nothing; an app is a good default compromise.

Method	Security	Who it's for
SMS code	basic – the most widespread, but the weakest	for everyone as a first step; better than nothing
Authenticator app	good – the code is generated on your phone	default recommendation for most people
Physical key / biometrics	highest – cannot be intercepted or misused remotely	for those who want the maximum for key accounts

SMS code

The most common method: after you enter your password, you receive an SMS with a code that you type in. It is the easiest to understand, but also the weakest – in exceptional cases it can be bypassed if someone gets the operator to transfer your number to another SIM card (this is called SIM swapping). Even so, SMS counts: anyone who turns on nothing because “SMS is weak” is worse off than someone who has at least SMS.

Authenticator app on your phone

An app on your phone generates a short code that changes every few moments. The code isn't sent anywhere – it is created right on the device, so it can't be intercepted on the way, and it works even without signal. It offers a sensible balance of security and convenience, which is why we recommend it as the default choice. There are several authenticator apps and they work across services – so you can use one app for your e-mail, bank and social networks at the same time.

The code in the app changes every few moments and your phone never sends it anywhere.

Physical key or logging in with a fingerprint or face

The most secure option. A physical key is a small device that you plug into a computer or hold against your phone; logging in with a fingerprint or your face works in a similar way. This method is practically impossible to misuse remotely. It suits those who want the maximum – typically for e-mail and banking.

Where to turn it on first

You don't have to turn it on everywhere at once. Go by importance, not by alphabet – and start with your e-mail. Why e-mail of all things? Because passwords for everything else are reset via e-mail. Whoever takes over your e-mail can gradually get into everything else as well.

Start with your e-mail — passwords for everything else are reset through it.

After e-mail, it's the turn of your bank and payments, then social networks (where your identity is at stake) and finally online shops with a saved card. In a few evenings, you'll have the essentials done. There's no need to rush – what matters is to start with your e-mail and bank; you can add the rest gradually, as each service comes to hand.

How to turn on two-factor authentication

The exact procedure differs slightly for each service and menus change from time to time, so we won't give you a click-by-click guide here that would be out of date in a year. In general, though, it works the same everywhere – and all you need is to know what to look for:

In your account, look for a Security, Sign-in or Privacy section.
Find an item such as two-factor authentication, two-step verification or simply two-factor / 2FA.
Choose a method (app or SMS) and follow the instructions – with an app, you usually scan a square QR code.
Finally, save the backup codes that the service offers you. Don't skip this step.

If you're unsure with a particular service, search its help pages for “two-factor authentication” – the official guide is always the most reliable.

What if I lose my phone

This is the most common reason why people don't turn on two-factor authentication – they're afraid of locking themselves out. You won't, if you prepare a backup in advance. You have three ways back in:

Losing your phone won't lock you out if you have backup codes or a second device.

1Use your backup codes. When you turn on authentication, the service will offer you a set of one-time codes. Print them out or write them down and keep them at home – not on your phone. With one of them, you can log in even without your phone.

2Log in from a second device. If you also use the service on a tablet or computer that it already trusts, it may not ask you for the second step again and you can restore access from there.

3Go through account recovery. If both fail, every major service has a recovery procedure via identity verification. It tends to be slower, but it works – and it's a safety net, not a dead end.

The most important tip in the whole article: save your backup codes as soon as you turn it on. A few minutes now will save you a lot of trouble if your phone ever ends up in a river.

The most common objections (and why they don't hold up)

“It slows me down.”

In reality, hardly at all. Services remember a device you trust and mainly ask for the second step when you log in from a new place. A few seconds once in a while in exchange for peace of mind is a good deal.

“Nobody will notice me.”

Password attacks aren't aimed at specific people – they're mass-scale and automated. They try leaked passwords on thousands of accounts at once. It's not about whether you're interesting, but whether you have a weak spot.

“I don't have a smartphone.”

No problem. Use an SMS code on an ordinary phone, or a physical key for your most important accounts. Two-factor authentication isn't just for people with the latest mobile.

Turn it on today – start with your e-mail. It takes a few minutes that will make your accounts a much harder target. And we take care of the security of your connection at network level – find out more on the UVT Security page.

Where to next

How to create a secure password – the foundation that two-factor authentication builds on.
How to spot a scam message – the most common way a password ends up in the wrong hands.
Ten rules for staying safe online – a quick summary of the principles.
What threatens you on the internet – an overview of the threats.

Frequently asked questions

Is an SMS code secure?

Of the three methods, an SMS code is the weakest – in exceptional cases it can be bypassed if someone persuades the operator to transfer your number to another SIM. Even so, it's much better than nothing. If SMS is the most convenient for you and you otherwise wouldn't turn on any authentication at all, turn on SMS. Ideally, though, switch to an authenticator app.

What if I have no signal or I'm abroad?

An authenticator app generates the code right on your phone and works even without signal or data – that's one of its advantages over SMS. If you rely on SMS, bear this in mind when you're abroad and it's best to prepare backup codes in advance.

Do I have to enter the code every time I log in?

Usually not. Services typically remember a device you trust and only ask for the second step when you log in from a new phone or computer, or after a longer period. Normal everyday use won't slow you down.

I received a verification code even though I'm not logging in. What does it mean?

It most likely means that someone knows your password and is trying to log in right now – and the second step has stopped them. Don't enter the code anywhere. As soon as possible, change your password for that service (and wherever you use the same one). You can tell whether such a message can be trusted with the help of our article on scam messages.

What if I lose my phone completely?

It won't lock you out if you have a backup ready. When you turn it on, most services give you backup codes – print them out and keep them safe. You can also log in from a second device that the service trusts, or via account recovery. We describe the procedure earlier in the article.

I don't have a smartphone. Can I have two-factor authentication?

Yes. If you don't have a smartphone for an app, use an SMS code on an ordinary phone, or for important accounts a physical key that plugs into a computer. There's almost always an option.

Is two-factor authentication the same as a strong password?

No, they complement each other. A strong password is the foundation – we explain how to create one in our article on secure passwords. Two-factor authentication adds a second step to it, which protects you even if the password leaks anyway.