Extra sign-in protection
An extra check for your account. Keep login codes private.
Press play when you’re ready. The next lesson won’t start automatically.
Your code. Your eyes only.
Multi-factor authentication (MFA) means using an extra check when you sign in. You may also see “two-step verification” or “2FA” in your account settings. The method depends on the service.
Remember these three things
- Look for extra sign-in protection in the security settings of important accounts, especially your email.
- Keep login codes private. Do not read them out to someone who contacts you unexpectedly.
- If a request feels wrong, end the conversation and open the service through a trusted app or known website address.
Further guidance: NCSC: turn on two-step verification. Written guidance checked against this source on .
Try the three-question quizRead the transcript
I use MFA. Am I completely safe?
Safer, but you still have to use it properly.
Approve sign-in, approve sign-in, approve sign-in.
If you didn't start the login, reject it.
Never approve one just to stop the notifications.
What if someone phones asking for the six-digit code?
Don't give it to them.
A verification code can be the final key into your account.
Visual description
A title explains MFA as an extra sign-in check. Byte receives repeated approval requests. A demonstration sign-in request highlights Deny and the instruction 'Did not start it? Deny it.' Query asks about a caller requesting a six-digit code. A demonstration phone shows a code and an unknown caller asking for it; the response says not to give it to them. The code is fictional and is not a real login code. The final portrait card repeats: Keep login codes private. Only approve logins you started.
Next: Spot the scam
Pause before you click. Check through a route you trust.