Two-factor authentication for your money: which kind to use and where to turn it on first

What a second factor does

Passwords leak. They are reused across sites, caught by fake sign-in pages and exposed when a company is breached. Two-factor authentication adds a second proof that is not a password: usually something you have, like your phone, or something you are, like a fingerprint.

With it on, someone who learns your password still cannot sign in without also holding your device. That single change defeats the great majority of account takeovers, which rely on passwords alone.

The kinds, from weakest to strongest

The key difference is whether a code can be given away. Anything you can read and type, you can be tricked into typing on a fake page. Passkeys and security keys remove that possibility.

• Text message or email codes. Far better than nothing, and the weakest option. A phone number can be moved to a criminal's SIM card by tricking a carrier, and codes can be read out to a scammer on the phone.
• Authenticator apps. An app on your phone produces a fresh six-digit code every thirty seconds, with no phone network involved. This is a solid default for most accounts.
• Push approvals. The service sends a prompt to its own app and you tap Approve. Convenient, but be suspicious of any prompt you did not cause; approving one out of habit lets an attacker in.
• Passkeys and hardware security keys. These check which website is asking before they respond, so a fake site gets nothing. They are the strongest protection available to ordinary users.

Which accounts to protect first

Email comes before the bank on purpose. A well-protected bank account behind a poorly protected inbox is only as safe as the inbox.

• Your email. Almost every other account can be reset through it, so it is the master key.
• Your mobile carrier account. Add a PIN or port-out lock so your number cannot be moved without it.
• Your banks, card issuers and investment accounts.
• Your password manager, if you use one.
• Budgeting and finance apps that can see your balances and transactions.

Do not lock yourself out

The common failure with two-factor authentication is not a break-in. It is a lost or replaced phone. Before you rely on it, set up the way back in.

• Save the backup codes a service gives you, somewhere that is not the phone itself: a password manager or a printed sheet at home.
• Use an authenticator app that can back up or transfer its accounts to a new phone, and check that it is switched on.
• Where a service allows it, register two methods, such as a passkey and an authenticator app.
• When you get a new phone, move your authenticator before you wipe the old one.

Codes are never for sharing

No bank, app or support agent needs you to read a code back to them. A caller or message asking for the code you just received is, without exception, someone trying to sign in as you. Hang up and call the number on your card.

Two-factor sign-in in My AI Fin App

The app supports two-factor authentication with any authenticator app, and signing in with a passkey counts as the second factor. Once it is on, the database itself enforces it: every table holding financial data refuses a session that has not passed the second step, so a stolen password with a valid session still cannot read your balances.

If you lose your authenticator, you can remove it after proving you control your email address with a one-time code. There are no printed backup codes yet, which is one more reason to keep that email account well protected.