Two-step verification: protect your accounts without locking yourself out

26 octubre 2026 · 01:33

(hora de La Paz)

By Erick León

Cybersecurity · Good practice 2 of 10

A password may not be enough

Multifactor authentication adds an access check beyond the password, depending on the service. It may use an authenticator app, security key or other mechanisms. They do not all provide the same protection. This is an important measure for email, social media and accounts connected to work or money.

Choose a method you can maintain

Check the alternatives in the official settings. Compatible passkeys and security keys can provide resistance to phishing. Codes sent by message have limitations but may improve on relying only on a password. Avoid changing methods without understanding how you will sign in if you lose your phone.

Save recovery information before you need it

If the service provides backup codes, keep them somewhere secure, separate from everyday access and outside shared documents. Do not publish them or send them to anyone. Check your recovery email and phone number too: an abandoned address can make recovering an account difficult.

Do not approve a request you did not initiate

Do not approve a sign-in notification just to make it stop appearing. Reject unexpected requests and go directly to the security section yourself. If you receive an unsolicited code, do not read it out to someone who claims to need it to help you. An attacker may try to persuade you to authorize their access.

Take care when creating passkeys on shared devices

A passkey lets you sign in using the unlocking mechanism of a compatible device. Before setting one up, check who can unlock that device and how the passkey is synchronized or recovered. Do not create one on a public computer or a phone you do not control.

Today’s task

Enable an additional authentication method for your main email and verify that you retain an alternative way to sign in. Then review devices and sessions. Google and INCIBE publish instructions for these features; exact steps vary by platform and version.