Setting up multi-factor authentication across your household's accounts
6 min read
If there's one security step worth prioritizing over everything else in this guide series, it's this one, multi-factor authentication blocks the vast majority of account takeover attempts even if a password is compromised, a single setting change that outweighs most other security precautions combined.
Where to start
Email accounts first, since they're often the recovery method for everything else, followed by banking apps and any account tied to payment information. These carry the highest real-world consequences if compromised, and email specifically is worth prioritizing since a compromised email account can often be used to reset passwords on everything else you own.
Choosing a method
An authenticator app (Google Authenticator, Microsoft Authenticator) is generally more secure than SMS codes, which can be intercepted through SIM-swapping in rarer, targeted cases. SMS is still far better than no second factor at all if that's the only option offered, don't let the search for the perfect method delay turning on a good-enough one today.
Why backup codes are the step people forget
Every major service offers backup codes generated at setup specifically for the scenario where you lose access to your authenticator app or phone. Skipping this step is one of the most common ways people end up genuinely locked out of their own accounts, precisely the outcome multi-factor authentication was supposed to protect against, not cause.
Rolling it out across a household without overwhelming anyone
Trying to set up MFA on every account for every family member in one sitting tends to be abandoned partway through. Starting with the highest-risk accounts (email, banking) for each person, then expanding gradually, is more likely to actually get fully implemented than an ambitious all-at-once approach that runs out of patience.
What we help with
We walk through setting up authentication apps across your household's key accounts and make sure backup codes are saved somewhere safe, so a lost phone doesn't lock anyone out of their own accounts, prioritizing the highest-risk accounts first rather than trying to do everything in one overwhelming session.