Account takeovers are one of the more preventable disasters in this work, and the fix is almost always the same: two-factor authentication, turned on everywhere, before it’s ever needed.
Why passwords alone aren’t enough
A leaked or guessed password is often all it takes to lose access to a platform account, payment processor, or email — and from there, an attacker can often chain access into other connected accounts. Two-factor authentication adds a second barrier that a stolen password alone can’t cross.
Where to enable it first
- Primary email — the account that can reset everything else if compromised
- Content platforms and payment processors
- Any password manager or cloud storage holding sensitive files
- Social and promotional accounts, even ones that feel lower-stakes
Authenticator apps over SMS
SMS-based two-factor is better than nothing, but it’s vulnerable to SIM-swapping attacks. An authenticator app tied to the device itself, not the phone number, is meaningfully more secure and worth the small extra setup step.
Password managers as the other half
Two-factor protects against a stolen password, but a password manager prevents weak or reused passwords in the first place. The two together close most of the common paths into an account.
What to do if you think you’ve been compromised
- Change the password immediately, from a device you trust
- Review connected devices and active sessions, and log out anything unfamiliar
- Enable two-factor immediately if it wasn’t already on
Closing reminder
Two-factor authentication takes minutes to set up and closes one of the most common entry points for account compromise. It’s the security baseline everything else builds on top of.
Related: a VPN and password manager combination rounds out the rest of a solid privacy and security baseline — worth setting up alongside two-factor, not after.