Turn on a second factor for every account that matters and prefer phishing-resistant forms (passkeys or hardware security keys), so that a password typed into a fake page or talked out of you on the phone is not enough to take the account.

How to do it

1. 1Start with the accounts that unlock the others: your primary email, your phone carrier account, your password manager, and your bank. Whoever controls your email can reset almost everything else.
2. 2Choose the strongest factor each service offers, in this order: a passkey or FIDO2 hardware security key; an authenticator app or a device prompt that shows a number to match; and only then codes sent by text message or voice call. Any second factor is much better than none.
3. 3Understand why the order matters. A passkey or security key is cryptographically bound to the real site's address, so it will not work on a look-alike domain. A six-digit code, however you receive it, can be typed into a fake page or read out to a caller and relayed by the attacker within seconds.
4. 4Treat one-time codes as something only you ever enter, only on a login you started. No employee of any company needs you to read a code to them; a request to do so is an account takeover in progress.
5. 5Deny every sign-in prompt you did not initiate, and then change that password, because an unexpected prompt means someone already has it.
6. 6Ask your mobile carrier to add a port-out PIN or number lock, and move important accounts off text-message codes where you can, since a hijacked phone number receives your codes.
7. 7Store recovery codes offline, register a second key or device as a backup, and use a password manager, which will decline to fill credentials on a domain it does not recognize.

When to use it

• •Now, before anything has gone wrong, for email, banking, carrier, password-manager, cloud-storage, and social accounts.
• •When a service offers a passkey or security-key option you have not yet enabled.
• •When you receive a login prompt or a verification code you did not request.
• •In an organization, for every remote-access, email, finance, and administrator account, with phishing-resistant factors for the most privileged.

Counters

Evidence and how strong it is

This is one of the few security countermeasures with large-scale quantitative support. Doerfler et al. (2019), analyzing Google account data, found that an on-device prompt blocked all automated bot attacks, about 99 percent of bulk phishing, and about 90 percent of targeted attacks, while text-message codes blocked about 96 percent of bulk phishing and 76 percent of targeted attacks; security keys blocked all of the attacks observed. NIST Special Publication 800-63B (2017) sets out the underlying assurance levels, classifies codes sent over the public telephone network as a restricted authenticator because of interception and number-hijacking risks, and defines resistance to verifier impersonation (phishing resistance) as a property of cryptographic authenticators. The US Cybersecurity and Infrastructure Security Agency's 2022 guidance names FIDO/WebAuthn authentication as the widely available phishing-resistant option and recommends number matching to blunt push-notification fatigue attacks. The FBI IC3 and the FTC both advise enabling multi-factor authentication and carrier-level protections against SIM swapping. Evidence strength: strong observational data at very large scale plus standards-body consensus; the figures come from one provider's accounts and describe attacks seen at the time, so they should be read as orders of magnitude rather than guarantees.

1. Grassi, P. A., Fenton, J. L., Newton, E. M., Perlner, R. A., Regenscheid, A. R., Burr, W. E., Richer, J. P., et al. (2017). Digital Identity Guidelines: Authentication and Lifecycle Management (NIST Special Publication 800-63B). National Institute of Standards and Technology · link
   Authenticator assurance levels, the restricted status of codes sent over the public telephone network, and verifier-impersonation (phishing) resistance as a property of cryptographic authenticators.
2. Doerfler, P., Thomas, K., Marincenko, M., Ranieri, J., Jiang, Y., Moscicki, A., & McCoy, D. (2019). Evaluating Login Challenges as a Defense Against Account Takeover. Proceedings of The World Wide Web Conference (WWW 2019)
   Large-scale measurement of how device prompts, text-message codes, and security keys performed against automated, bulk-phishing, and targeted account-takeover attempts.
3. US Cybersecurity and Infrastructure Security Agency (CISA) (2022). Implementing Phishing-Resistant MFA (fact sheet). cisa.gov
   The identification of FIDO/WebAuthn as phishing-resistant, the weaknesses of text-message and push-based factors, and number matching as a mitigation for push fatigue.
4. Federal Bureau of Investigation, Internet Crime Complaint Center (IC3) (2022). Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public (Public Service Announcement I-020822-PSA). ic3.gov
   Law-enforcement description of SIM-swap account takeovers and the advice to use stronger authentication than text-message codes and to secure carrier accounts.