Two-Factor Authentication: The Order to Turn It On

Passwords leak. Big companies get breached, old accounts get forgotten, and the same password ends up reused in more places than anyone remembers. When that happens, the only thing standing between a stranger and your account is a second step.

That second step is two-factor authentication (2FA). This guide explains what it is, which kind to choose, and — most useful of all — the order to turn it on so the accounts that matter most are protected first.

What two-factor authentication actually does

With 2FA on, signing in needs two things instead of one:

Something you know — your password.

Something you have — usually your phone, which shows a short code or asks you to approve the sign-in.

Someone who has stolen your password still can't get in, because they don't have your phone. That single change stops the most common account takeovers: people trying leaked email-and-password pairs on other sites.

Which kind of 2FA to choose

Not all second steps are equal. From strongest to weakest:

Security keys and passkeys. A physical key or a passkey stored on your phone. Very hard to phish, because they only work on the real website.

Authenticator apps. An app on your phone shows a new 6-digit code every 30 seconds. Works offline and is a big step up from a password alone.

Text-message (SMS) codes. Better than nothing, but a criminal who talks your mobile carrier into moving your number to a new SIM can receive your codes. Use it only where nothing else is offered.

If a service offers an authenticator app or a passkey, pick that over SMS.

The order to turn it on

You don't need to do everything today. Do it in this order and the most important doors are locked first.

1. Your main email

Your email is the master key. Almost every other account lets you reset its password by email, so whoever controls your inbox can take over the rest. Turn on 2FA here before anything else.

2. Your bank and payment accounts

Banking apps, cards, payment services and any crypto wallet. Most banks already ask for a second step — check that it is on and that the phone number or app it uses is current.

3. Your Apple ID or Google account

These hold your backups, photos, saved passwords and app purchases. On iPhone: Settings → [your name] → Sign-In & Security → Two-Factor Authentication.

4. Your password manager and cloud storage

If you use a password manager, protect it with 2FA — it holds every other password. Do the same for cloud drives that store documents or ID scans.

5. Social media and messaging

These are favourite targets for scams sent "from you" to your friends. Turn on 2FA in each app's security settings.

6. Everything else

Shopping sites, work tools, games, and the apps you use every day — including your VPN. Your CasperVPN account has two-factor authentication too: Profile → Security.

Don't lock yourself out

2FA protects you only if you can still get in when your phone is lost or replaced.

Save your backup codes. Most services give you a set of one-time recovery codes when you turn on 2FA. Keep them in your password manager or printed somewhere safe — not in a photo on the same phone.

Move your authenticator app before you change phones. Many authenticator apps can transfer their accounts to a new device; do it while the old phone still works.

Keep your recovery email and phone number up to date on every account you protect.

A five-minute start

If you only have five minutes today, turn on 2FA for your main email and save its backup codes. Tomorrow, do your bank. By the end of the week, the accounts that matter most will need more than a leaked password to open.

---

CasperVPN encrypts your internet connection with WireGuard, OpenVPN, IKEv2 and CasperCloak, our own protocol, on iPhone and iPad (Mac app coming). Download CasperVPN →