Cybersecurity · Beginner level

Beginner level · Module 1: Passwords, MFA and Account Safety · Lesson 3 of 3

Multi-Factor Authentication and Recovery

Add a second factor so a stolen password alone cannot open your account.

In this lesson you will

  • Enable MFA using an authenticator app or security key
  • Store recovery codes safely

Key concepts

something you know, have, areauthenticator appsSMS codesrecovery codes

The lesson

Multi-factor authentication (MFA) requires something you know (a password) plus something you have (a phone app or security key) or something you are (a fingerprint).

Authenticator apps and security keys are stronger than SMS codes, which can be intercepted or moved to another SIM. SMS is still much better than no second factor.

When you enable MFA, save the recovery codes offline. Never share an MFA code with anyone: a real company will not ask for it.

Step by step

  1. Install an authenticator app.
  2. Enable MFA on your email account.
  3. Save the recovery codes offline.
  4. Sign out and sign in again to test it.

Practice activity

Enable MFA on email, banking or mobile money and your main social media account.

Expected result: MFA enabled and tested on at least three high-value accounts, with recovery codes stored.

Check your understanding

  1. Why is an authenticator app stronger than SMS?

    Show answer

    SMS codes can be intercepted or redirected through SIM swapping.

  2. Should you ever read an MFA code to someone who calls you?

    Show answer

    No, never.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.