Set up multifactor authentication you can recover
Secure the important accounts while keeping a documented route back in.
Start with the accounts that unlock others
Email, password managers, and primary device accounts deserve attention early because they can help recover many other services. CISA's guidance explains how an additional sign-in factor adds protection beyond a password. List the accounts that would cause the largest disruption if somebody accessed them. Include work accounts according to your organization's rules. Choose a calm time to set up authentication and keep your existing session open while testing. A hurried change made just before travel or a deadline can turn a sensible security improvement into a recovery problem you could have prevented.
Choose supported methods deliberately
Read the service's current security page and compare its available methods. A physical security key, passkey, authenticator code, and text message work differently and do not offer identical protection. Prefer stronger supported options where they fit your devices and recovery needs. If a service offers only a limited choice, use the available protection while keeping the account's other settings strong. Avoid treating every additional prompt as automatically safe. A code or approval request you did not initiate should be investigated through the official account interface, rather than accepted to make the notification disappear.
Save recovery information securely
When setup generates backup codes, store them somewhere accessible if the phone is lost. Avoid keeping the only copy inside an account that requires the lost phone to open. Use your established secure storage method and label the codes with the service name and creation date. Check whether codes are single-use and replace the stored set when the service issues a new one. Where allowed, add a second supported authenticator. For work accounts, follow the administrator's recovery process rather than inventing a separate route that violates policy or leaves colleagues unable to assist you.
Test an ordinary failure
Sign out and back in with the new method. Then imagine the phone is unavailable and verify the documented recovery route without unnecessarily resetting the account. Read the instructions for replacing an authenticator before you need them. If you use a new phone, transfer or recreate authentication access before erasing the old one, following the relevant provider's current steps. Review trusted devices and active sessions while you are in the security settings. Removing an abandoned device can be as useful as adding another factor to a session you no longer control.
Keep the setup maintainable
Record which method protects each important account and where recovery material lives. The record should describe your arrangement without exposing secret codes to everyone who can read it. Review it after a phone replacement, move, or account change. Explain the process to a trusted person if they may need to help you during an emergency. Security improves when the routine is understandable enough to keep using. A successful setup produces both stronger sign-in and a clear recovery path, reducing the temptation to disable protection at the first inconvenient prompt.
Sources & further reading
Source links support the factual context. Practical examples and suggested workflows are original editorial guidance. Sources checked October 5, 2026.
Spotted something we should correct? Send a correction. Read our editorial policy.
