Turn on two-step verification for your email, payment and social accounts, and prefer a confirmation pop-up on your phone over a text-message code

Cost

Free. Set it up once per account, in two or three minutes.

What you get

Google looked at 350,000 (35万) real attempts to take over accounts (also called account hijacking). One kind of check relies on a device, such as a pop-up on your phone that you tap to confirm, or a plugged-in security key. This kind blocked "more than 94% of hijacking attempts that began with phishing and 100% of automated hijacking attempts." Phishing means tricking you into typing your password on a fake website. Automated means a machine trying leaked passwords in bulk. The other kind relies on answering questions, such as where you last signed in or what your backup email is. This kind "blocked as few as 10% of phishing hijackings and 73% of automated hijackings."

Notes

The same study also found that this kind of check sometimes locks out the real owner. 52% of real users failed to get in the first time, though 97% got in in the end. Turn it on for your email first, because most other accounts can recover their password through email. Use a verification code only for yourself. For what you take on if you read codes out to others or let them scan your face, see §8.45 (reading out verification codes).

Evidence grade

A : Specific numbers from meta-analyses, large cohorts or randomized trials; for law and policy, the statute or official text.

Sources

1. Doerfler P, Thomas K, Marincenko M, et al. (2019). Evaluating Login Challenges as a Defense Against Account Takeover. The World Wide Web Conference (WWW '19). https://doi.org/10.1145/3308558.3313481

Translated from the Chinese original. Original book, section 14, tip 1. Content may be out of date and rules differ by place. When you actually deal with an agency, a doctor or a court, follow what local officials, doctors and lawyers tell you. Disclaimer