Two-step login: app or text?
Two-step login (also called 2FA or MFA) asks for a second thing after your password. Any kind is much better than none. Some kinds are stronger.
CISA says to turn on MFA for your accounts, especially email, banking, and social media. (CISA: Turn on MFA)
From strongest to weakest
| Type | How it works | Watch out for |
|---|---|---|
| Passkey or security key | Face, fingerprint, or a small USB/NFC key you tap | Keep a backup key or recovery code |
| Authenticator app | An app on your phone shows a new 6-digit code every 30 seconds | Never read the code to anyone who calls you |
| Text message (SMS) code | A code is texted to your phone | SIM swap scams can steal your texts |
What is a SIM swap?
A scammer tricks your phone company into moving your number to their phone. Then your texts, including login codes, go to them. The FCC explains SIM swapping and port-out scams here: FCC: Cell phone fraud.
The FCC says a common first sign is that your phone suddenly loses service. (FCC SIM swap tip card (PDF))
Protect your phone number
- Ask your phone company to add a PIN or password to your account. (FCC tip)
- Turn on email and text alerts for your important accounts. (FCC tip)
- Do not share personal details that are used to verify you on social media. (FCC tip)
- Where you can, switch bank and email logins from text codes to an app, a passkey, or a security key.
The number one rule
No real company will call and ask you to read them a login code. If someone asks, hang up.
General information only. Not legal, financial, or security advice, and not a guarantee. Check with the company or agency involved.
Links checked November 5, 2026. If a page moved, search the agency site for the title.