Compromised passwords remain one of the most common ways attackers get in. Two-factor authentication means a stolen password on its own is not enough. It is the highest-value hour of security work available to most people.
Do email first
This is the part people get wrong. They protect the bank and leave email open. But every password reset in your life goes to your email — protect it and you protect everything downstream. Protect the bank alone and someone with your email can simply reset the bank.
Order: email, then password manager, then banking and payments, then anything with your card saved, then social media.
Not all second factors are equal
- Hardware key (YubiKey and similar) — strongest, and effectively immune to phishing. Worth it for a business owner or anyone handling money.
- Authenticator app (Microsoft Authenticator, Google Authenticator, Authy) — the right default for nearly everyone. Free, works offline, far stronger than text messages.
- Text message — much better than nothing, and weakest of the three. Numbers can be ported away from you. Use it where nothing else is offered.
Save the recovery codes
Every service gives you a set of one-time backup codes when you switch this on. Almost nobody saves them, and it is the single most common way people lock themselves out permanently. Print them, or put them somewhere that does not depend on the phone you are protecting. Codes stored only on that phone are worthless the day it is lost.
Getting a new phone
Move your authenticator app before wiping the old handset. Most now offer an export or cloud sync — use it while you still have both devices. Doing this in the wrong order turns a ten-minute job into a week of identity checks with a dozen support desks.
If any of this is beyond where you want to go on your own, a Koadi technician can take it from here — remotely anywhere in the US, or on-site in New Jersey, New York and Pennsylvania. Describe the problem in your own words and someone who does this every day will pick it up.