Turn on two-step verification. Prefer the prompt
In one line
In a Google study, device prompts blocked over 94% of phishing takeovers and 100% of automated ones. Prompts beat text-message codes. Start with email.
What it costs
Free. Two or three minutes per account.
What you get
Doerfler et al. (2019) looked at about 350,000 takeover attempts. On-device prompts and security keys stopped over 94% of phishing attempts and 100% of automated ones. Secret questions sometimes stopped only about 10% of the phishing attempts.
How strong the evidence is
Source
Doerfler P et al. (2019). WWW ’19.
Watch-outs
Real users sometimes get locked out on the first try. In the study, 52% failed the first challenge and 97% eventually got in. Protect email first, because other accounts recover through it. A code that arrives is for you alone.
Adapted from HowToLiveBetter item 14-1.
Next habitRelated
Best valueA lock screen on the phone, a PIN on the SIM
A lost phone still has a SIM. Someone can move that SIM and receive your codes. A SIM PIN stops that at the moment they move the card.
Lost the phone? Suspend the SIM first
The order is: suspend the SIM, lock the phone remotely, change email and payment passwords from a computer, file a police report, then freeze cards if you need to. You can call the carrier from a borrowed phone.
The email password is used nowhere else
A password leaked from another site can open your email. Once email is open, every account that recovers through it can fall together.