How to turn on two-step verification for your email

Before you start

• The phone you use every day is with you, charged and unlocked.
• You know your current email password.
• You've chosen a safe place for backup codes: a password manager, or a printed copy kept somewhere secure at home. Not only on the same phone.

0 of 3 done. Ticking just helps you keep track; nothing is saved or sent.

Menu names vary between versions and change from time to time. If what you see doesn't match exactly, look for the closest option.

Steps

Gmail (Google account)

1. 1

   Open your Google Account's security settings

   On a computer, go to your Google Account and open Security (on some versions, Security and sign-in).

2. 2

   Turn on 2-Step Verification

   Find 2-Step Verification and choose Get started or Turn on. Follow the prompts. Google will usually offer to send prompts to your phone, which you approve with a tap.

3. 3

   Add a backup

   Add a backup method, such as a phone number for text codes, and create backup codes. Save them somewhere safe.

Outlook.com and Hotmail (Microsoft account)

1. 1

   Open your Microsoft account's security settings

   Sign in to your Microsoft account online and open Security.

2. 2

   Find two-step verification

   Look for Manage how I sign in, or Advanced security options, then find Two-step verification and choose Turn on.

3. 3

   Save the recovery code

   Follow the steps. Microsoft may suggest its Authenticator app. When you're shown a recovery code, write it down or save it securely.

If you use Outlook through work or a school, two-step verification is usually controlled by that organisation. Ask their IT contact instead.

iCloud Mail (Apple Account)

1. 1

   Check it's already on

   Most Apple Accounts already have two-factor authentication switched on. On an iPhone or iPad, open Settings, tap your name, then Sign-In and Security (Password and Security on older versions).

2. 2

   Turn it on if needed

   Check that Two-Factor Authentication shows as on. If not, tap it and follow the steps.

3. 3

   Add a second trusted number

   Add another trusted phone number if you can, such as a family member's, in case you lose your phone.

Other email providers

Many other providers, including Yahoo and some broadband providers' email services, offer two-step verification too. Look in the account's Security or Account settings area, or search the provider's own help pages.

After you turn it on

• Test it

  Sign out on a computer and sign back in, to make sure the second step works.

• Check your backups

  Confirm the backup phone number and codes are somewhere you can reach without your phone.

• Update your email apps

  Some older mail apps may ask you to sign in again. Your provider's help pages explain what to do.

If this happens, try this

• If you lose your phone

  Use another device to sign in with a backup code, a second phone number or a trusted device. Then remove the lost phone from your account's trusted devices.

• If you've lost your phone and your backup codes

  Use the provider's account recovery process from its official website. It can take a while, so start it as soon as you can.

• If you get a sign-in prompt you didn't ask for

  Don't approve it. Someone may know your password, so change it straight away. Our guide to strong passwords you can remember can help.

Things to be careful about

• Code scams. Your email provider won't phone you and ask you to read out a verification code. If anyone asks for a code you didn't request, don't share it. Our guide to spotting scam texts, emails and calls explains more.

• Backup codes kept on the same phone. If the phone is lost, so are the codes. Keep a copy somewhere else.

• Your phone going in for repair. Move two-step verification or save backup codes first. See backing up before a repair.