Seven Common Mistakes When Setting Up Two-Factor Authentication on UK Accounts

Two-factor authentication is the closest thing most of us have to a seatbelt for online accounts. Switch it on and a stolen password stops being a catastrophe: whoever has it still needs your phone, your authenticator app or a one-time code. That is the theory. In practice, plenty of 2FA setups are held together with hope and a screenshot of some backup codes buried in a camera roll.

The mistakes below are the ones that turn a decent security feature into an afternoon of password resets and a long wait on a helpline. None of them are exotic, and all of them are fixable in about ten minutes.

Saving backup codes badly, or not at all

Almost every service hands you a set of backup codes the moment you turn on 2FA, then never mentions them again. People close the tab. Six months later their phone goes for a swim, and those codes were the only way back in. Without them you're relying on account recovery, which can take days or fail outright if you can't prove the account is yours.

Store them somewhere that isn't the thing you're protecting. A few options that work:

• Print them and keep the sheet with your passport, birth certificate or other documents you'd grab in a hurry.
• Save them in a password manager, then also keep a printed copy, because the manager itself may ask for your 2FA.
• Put them in an encrypted file on a device that has nothing to do with the account.

Two details people miss. Each code is single-use, so cross off the one you've spent rather than assuming the list is intact. And if you regenerate the list, the old codes stop working immediately, so replace your stored copy the same day.

Assuming SMS is enough, and never updating your number

Text-message codes are better than nothing, but they're the weakest form of 2FA most of us use. They can be intercepted, and they depend on a phone number you may not control forever. UK mobile numbers are eventually recycled, so a number you gave up can end up in a stranger's hands. If that number is still the recovery route on an old email account, you've handed someone a key and posted it to them.

Where a service offers app-based codes, security keys or passkeys alongside SMS, use them. Where SMS is your only option, treat your number as something to maintain. Update it on every account before you cancel the old SIM, and keep that SIM active for a month or two in case something slips through.

One authenticator app on one phone

Authenticator apps hold the secret that generates your codes locally. Some back those secrets up to a cloud account; others don't, and a factory reset wipes the lot. Before you rely on an app, find out which kind you've got.

Give yourself a second route

Where a service allows it, register the same account on two devices: scan the QR code on your phone, then again on a tablet or a spare handset kept in a drawer. A hardware security key is sturdier still if you're protecting email or a business account. Either approach means a lost phone is an annoyance rather than a week of recovery forms.

If you use a password manager that generates codes as well as storing passwords, you gain convenience and take on a single point of failure. That's a fair trade for plenty of people. Just make sure the manager's own account has 2FA and that you can get back into it.

Leaving recovery details to rot

Account recovery is where most 2FA setups quietly fall apart. The recovery email is an address you stopped using in 2019. The recovery phone is your old number. The security question is "mother's maiden name", and the answer sits on the electoral roll.

Spend ten minutes in the security settings of your main accounts and check three things:

1. Is the recovery email one you actually check?
2. Is the recovery phone current, and is it a number you plan to keep?
3. Do the security answers use nonsense you've saved in your password manager?

Some providers also offer trusted contacts who can help you back in. Naming one is far less painful than proving your identity to a support team that has never heard of you.

Approving prompts you didn't ask for

Push-based 2FA is convenient, which makes it easy to approve a login on autopilot. That's exactly what criminals count on: if they already have your password, they will sometimes send prompt after prompt until you tap "approve" just to make it stop. If your app supports number matching, where you type the two digits shown on the screen you're logging into, turn it on.

An unexpected prompt is a warning, not a nuisance. It means someone has your password. Deny it, then change that password straight away, along with any other account that used it.

Related: never read a one-time code out to someone who contacts you. No bank, broadband provider or tax office rings up and asks for a code, even when the caller ID looks right and they know your address.

Setting it up once and never testing it

The moment you need 2FA is usually the worst moment to discover it doesn't work. Test it on purpose. Log out, then log back in from a different browser or device and confirm a code arrives and is accepted.

Watch for two things. Devices with the wrong clock generate wrong codes, so if your codes keep being rejected, check that your phone's date and time are set automatically. And if you're travelling, plan ahead: roaming charges, a flat battery or a new local SIM can all cut you off. Download your backup codes before you fly and keep them somewhere you can reach without a data connection.

A ten-minute audit worth doing tonight

Pick your two most important accounts, usually your main email and your bank, and work through this: confirm the recovery details are current, store your backup codes offline, check that your authenticator app has a second device or a key behind it, and test one full login from password to code.

Then repeat for anything holding money, medical records or your identity. It isn't glamorous work, and nothing will feel different afterwards. That's the point. A good 2FA setup should be invisible until the day it saves you.

Photo: Boskampi / Pixabay