Multi-Factor Authentication: Which Accounts, In Which Order

Additional resource for the lesson “Multi-Factor Authentication: Combining the Factors” — Online Security course

Multi-factor authentication is not a single setting you switch on once. It is a decision you make account by account, and the order matters more than the total. This resource is about choosing that order sensibly rather than starting wherever you happen to be.

A. Why this matters

Multi-factor authentication — MFA, or 2FA when there are exactly two — means requiring more than one category of proof to sign in. The companion resource on authentication factors covers what those categories are; the one on why to use it covers the reasoning.

What is left, and what this resource is about, is the practical question nobody answers: you have thirty accounts and limited patience. Where do you start?

B. Key concepts

Six ideas about coverage and priority.

MFA and 2FA

Multi-factor authentication is the general term for requiring two or more categories of proof. Two-factor authentication is the common case with exactly two.

Why it matters to you: The terms are used interchangeably in most services’ settings. Both describe the same thing you are looking for.

Email as the recovery account

Most services send password resets and confirmation codes to your email address.

Why it matters to you: Whoever controls that mailbox controls, in practice, most of what it can reset. This is why it comes first regardless of what else is on your list.

Critical accounts

Primary email, online banking, work accounts, cloud storage holding documents, main social accounts, national digital identity where you have one.

Why it matters to you: These are the accounts where a compromise reaches into your finances, your work or your reputation. Everything else can wait.

Account resilience

The ability to withstand a mistake — a reused password, a leaked database, a moment of inattention — without losing the account.

Why it matters to you: MFA is the measure that buys the most resilience per minute spent. It does not prevent errors; it stops them from being final.

Backup codes and recovery

The one-time codes a service gives you when you enable MFA, for when the phone is unavailable.

Why it matters to you: Save them somewhere reachable without the phone. The most common way people lose an account to MFA is not an attack — it is a replaced handset and no codes.

Not all second factors are equal

SMS is the weakest, authenticator apps are considerably better, hardware keys and passkeys are the strongest.

Why it matters to you: Worth knowing, but not worth stalling over: any second factor beats none. The comparison has its own resource when you want to upgrade.

C. A practical example: the order that saved the rest

Sara uses the same password for her email and her social accounts. She falls for a convincing fake login page for the social network and enters her credentials. The attacker now has an address and a password that work in two places.

If she had started with the social account

The social account would be protected, and the email would not. The attacker signs into her mailbox, resets the social password through it, and the second factor she enabled is bypassed rather than defeated.

Because she started with email

• The attacker reaches the mailbox and is asked for a code from her authenticator app.
• The sign-in stops there, and Sara receives a notification of the attempt.
• She changes the password on both accounts before anything else happens.

D. Try it yourself: design your coverage in ten minutes

The output is a short list, not a finished job. That is the point.

Step 1 — List your critical accounts (3 minutes)

• Three personal: primary email, cloud storage, bank or payment service.
• Two work: company email, and whichever internal system holds the most.

Step 2 — Check each one (5 minutes)

• Is MFA available? Yes, no, or not sure.
• Which method would you choose: authenticator app, hardware key, or SMS if nothing else is offered?
• What is the concrete next action — turn it on yourself, or ask whoever administers the account?

Step 3 — Do one now (2 minutes)

• Enable MFA on one account before you close this page. Email if it is not already done.
• Save the backup codes while you are there.

Then finish the sentence: today I better protected my ______ account by turning on ______. The list you made covers the rest, whenever you get to it.

E. Videos, articles and further resources

Independent and institutional sources in English.

CISA — Turn on multi-factor authentication
The agency’s guidance for the public, including which accounts to prioritise.
https://www.cisa.gov/secure-our-world/turn-mfa

NCSC (UK) — Turn on 2-step verification
The clearest short case for starting with email rather than anywhere else.
https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/activate-2-step-verification-on-your-email

NCSC (UK) — Passkeys are more secure than traditional ways to log in
Where multi-factor sign-in is heading: passkeys, supported by most devices as of 2026.
https://www.ncsc.gov.uk/blogs/passkeys-are-more-secure-than-traditional-ways-to-log-in

NIST — Digital Identity Guidelines, SP 800-63B (Revision 4)
The August 2025 standard behind most modern password advice. Technical, but this is where ‘length over complexity’ comes from.
https://pages.nist.gov/800-63-4/sp800-63b.html

NCSC (UK) — What to do if your account is hacked
What to do if an account is compromised despite everything. Worth reading before you need it.
https://www.ncsc.gov.uk/section/respond-recover/hacked-accounts

CISA — Secure Our World
The US cyber security agency’s public programme: four basic actions, explained for people who are not IT professionals.
https://www.cisa.gov/secure-our-world

Links checked in August 2026.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behavior

This lesson sits on the Skills pillar at level FL2: knowing what to do is easy, knowing what to do first is the skill.

Skills

• Enabling MFA on at least one service without needing help.
• Telling weaker methods from stronger ones, well enough to make a choice.
• Storing backup codes somewhere that does not depend on the phone.

For professionals and organizations

• Identifying which internal accounts have the same leverage that personal email has, and covering those first.

Awareness

• Moving from ‘a strong password is enough’ to understanding that it no longer is.
• Recognising how credentials are actually taken: phishing and breaches, not clever guessing.
• Seeing why the recovery account matters more than the accounts it recovers.

For future instructors and ambassadors

• Teaching the order rather than the list. People who start with email finish; people who start alphabetically stop.

Secure Behavior

• Turning on a second factor systematically for email, banking and work accounts.
• Reviewing security settings and access logs on critical accounts from time to time.
• Treating MFA as part of creating a new important account, not as a later improvement.

For organizations

• Making MFA a minimum requirement for remote access, and providing the method rather than leaving the choice open.

G. Questions to sit with

1. Which account, if someone were inside it for a day, would cause you the most trouble? Is it protected by more than a password?
2. Is your primary email covered? If not, is there a reason, or has it simply not come up?
3. Where are your backup codes? Could you reach them without your phone?
4. How many of your critical accounts would still be reachable if your phone were lost today?
5. What would you say to a colleague who finds MFA an annoyance rather than a protection?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database, in the order worth applying them.

The second factor, in priority order

• R4 — Turn on multi-factor authentication, preferably an authenticator app or hardware token.
• R8 — Turn on login limits and alerts, so an attempt reaches you quickly.
• MS17 — Protect the email linked to your bank with a strong credential and a second factor.

Minimum commitment: Primary email, then banking, then work, then main social accounts. In that order.

The first factor, which MFA does not replace

• R1 — Do not reuse passwords across accounts.
• R2 — Use a reliable password manager.
• R3 — At least 16 characters with mixed character types.
• MS1 — Generate rather than invent.
• MS2 — Use autofill, which also avoids entering credentials on fraudulent pages.

The device and the connection

• R6 — Keep software up to date, with automatic updates on.
• R9 — Connect over HTTPS only.
• MS4 — Use an alphanumeric passcode of 8 characters or more on the device that holds your second factor.

Five steps that fit in an afternoon

1. Turn on MFA for your primary email today.
2. Choose an authenticator app rather than SMS, where the option exists.
3. Save the backup codes somewhere reachable without your phone.
4. Make sure the phone itself has a strong passcode.
5. Turn on suspicious-login alerts where the service offers them.

That covers the account with the most leverage over everything else. The remaining accounts can follow one at a time.

In short

• MFA and 2FA describe the same thing: more than one category of proof.
• Email first, because it is the account that resets the others.
• Any second factor beats none — do not stall waiting to choose the best one.
• Backup codes are what stop MFA from locking you out of your own account.

Related resources in this course

The reasoning, the vocabulary and the comparison:

• Doubling Your Security: Why Use Two-Factor Authentication
• Authentication Factors: Something You Know, Have, or Are
• Two-Factor Authentication Methods: Not All Equal

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.