Turn on stronger sign-in
Want more background?
The idea in everyday life
Prefer passkeys or hardware security keys where supported, then authenticator apps, with SMS as a weaker fallback when nothing stronger is available. Register more than one safe method, store recovery codes securely, and remove obsolete devices.
Multifactor authentication (MFA) uses more than one kind of proof to sign in. Protect backup sign-in and recovery methods too; a weak fallback can let someone bypass stronger protection.
One step at a time.
Use the sample or information you have permission to use. Keep your work as you go. You can pause between steps.
- 1
Prefer passkeys or hardware security keys where supported, then authenticator apps; use SMS when stronger options are unavailable.
- 2
Register at least two recovery-capable authenticators or keys for critical accounts.
- 3
Save single-use backup codes offline and remove obsolete phones, sessions, app passwords, and trusted devices.
- 4
Protect the mobile-carrier account with a PIN and port-out protection when available.
See how it works.
Sam adds two security keys to primary email, keeps one separate, stores recovery codes offline, and removes an old phone. A bank that offers only app approval is secured with that method and carrier-account protections are strengthened to reduce SIM-swap risk.
Did you cover these?
- The strongest available method is enabled on critical accounts.
- A tested backup method exists and is not stored with the primary device.
- Push prompts are denied unless you initiated the sign-in.
What to finish
Strong MFA enabled and tested on every master-key account with offline backup codes.
Watch for this
Enabling MFA on one phone with no backup, then losing access when the phone fails.
How can I tell I understand it?
You can sign in and recover without relying on a single device or insecure fallback.
Quick knowledge check
Answer all 3 questions. Get at least 2 right and the lesson completes automatically.
You’ll get an explanation for each answer. Signed in? Your results save to your account.
Pass the check. We’ll save the progress.
Answer all 3 questions above and get at least 2 right. You can review the explanations and try again.
Go to the knowledge checkOptional course overview video · same video as Lesson 1
Secure Our World
From Cybersecurity and Infrastructure Security Agency. Watch here or open it on YouTube .
Compare the MFA options in CISA's materials with each provider's current security settings; choose phishing-resistant methods wherever they exist.Tools, templates, and lesson sources
Tools and templates
Tools open in a new tab so you can keep your place here.
Sources and further reading
Explore the references behind this lesson.
Report a problem with this lesson
Tell us what went wrong. Please leave out personal information and private project contents.