How to set up two-step verification on Gmail, WhatsApp and Instagram
Two-step verification means a stolen password alone is not enough to get into your account. It takes five minutes per app.
Gmail
Open your Google Account, go to Security, then 2-Step Verification and follow the steps. Use the Google prompt on your phone or an authenticator app rather than only SMS.
Settings, Account, Two-step verification, Turn on. Set a six digit PIN and add an email so you can reset it.
Settings, Accounts Center, Password and security, Two-factor authentication. Choose an authenticator app for the strongest option.
Save the backup codes somewhere safe, offline. They are your way back in if you lose your phone.
Why it matters so much
Two-step verification, also called two-factor authentication or 2FA, adds a second check after your password. Even if someone steals or guesses your password, they still need your phone or a code. It blocks the vast majority of automated account takeovers and is one of the most effective security steps you can take for free.
SMS codes vs authenticator apps vs passkeys
- SMS codes: easy and better than nothing, but vulnerable to SIM swap fraud and to people tricking you into sharing the code
- Authenticator apps such as Google Authenticator or Microsoft Authenticator: codes are generated on your phone, so they cannot be intercepted by SMS
- Passkeys: a newer method that uses your phone's fingerprint or face unlock instead of a password and resists phishing very well
More accounts worth protecting
- Banking and UPI apps: use the app lock and never share OTPs
- Amazon and Flipkart: saved cards and addresses make these valuable
- Facebook and X: often used to scam your contacts
- Microsoft and Apple accounts: they control your devices and cloud files
- Your password manager
If you lose your phone
This is why backup codes matter. Store them on paper at home or in your password manager. Add a backup phone number or email to important accounts, and if you use an authenticator app, check whether it supports cloud backup or transfer to a new phone.
Frequently asked questions
Someone sent me an OTP I did not request. What should I do? Do not share it with anyone. It usually means someone tried to log in with your password. Change that password and check your recent login activity.
Will 2FA make logging in annoying? Most services remember trusted devices, so you are asked for the second step only occasionally.
No genuine bank, company or government office will ever ask you to read out an OTP over the phone.
