Turn on two-factor sign-in

A password can be guessed, stolen through phishing or exposed in a data breach. With two-factor sign-in, you also need something only you have – usually your phone or a security key. If you use ID Austria, you already know the principle: there, a second factor is added to your password, for example the “ID Austria” app.

The options

• Code by text message: widespread and better than no second factor at all.
• Authenticator app: keeps generating new codes on your phone that you enter after your password.
• Security key: a small stick that you plug in via USB and tap to sign in, or hold to your phone contactlessly (NFC).
• Passkey: replaces password and code – you sign in the same way you unlock your phone or computer, with your fingerprint, face or PIN.

One important difference: if you enter a code from a text message or app on a fake site, an attacker can use it straight away. Even just approving a sign-in with a tap in an app offers only limited protection against this. So open sign-in pages yourself – via a bookmark or the provider’s app, not via links in emails or text messages. Only approve sign-ins you’ve just started yourself, and never pass on codes – not even over the phone.

Passkeys and security keys, by contrast, are tied to the genuine website and don’t work on fake sites. If a site where you normally use a passkey or security key suddenly asks for a code, check the address carefully.

Where to start

Turn on two-factor sign-in wherever a service offers it – many have it switched off by default. You’ll usually find it in the account’s security settings, sometimes under a different name. These accounts come first:

• Your email inbox – it can be used to reset the passwords of many other accounts.
• Your password manager.
• Accounts with far-reaching rights: social media, website, domain, accounting.
• Online shops you buy from (for online banking, your bank requires the second factor anyway).

So you don’t lock yourself out

If your phone is lost or broken, getting back into your account without preparation is often hard or even impossible. So when setting it up, check how you’d regain access in an emergency: many services give you recovery codes for this – keep them somewhere safe, separate from your phone. Where possible, also set up a backup, such as a security key.

If you use our services, you set this up for your account in the client area: under “Manage account”, then “Sign-in & security” – with authenticator app, security keys, passkeys and recovery codes.