An extra sign-in check is often called two-step verification, two-factor authentication or 2FA. It asks for something more than the password, such as a prompt in an app, a code or a security key.
Where to start
- Email account
- Banking and payment services
- Password manager
- Social-media and messaging accounts
- Shopping accounts that store payment details
Keep recovery options safe
Store backup codes securely and keep recovery telephone numbers and email addresses current. Do not share a sign-in code with a caller or message sender. A code may be authorising access or payment.
Unexpected approval request?
Deny it. Then change the account password and inspect recent activity. Repeated unexpected prompts may mean somebody knows the password.