2FA Security Checklist: 12 Steps to Lock Down Your Accounts Today

Why a Security Checklist Beats Good Intentions

When an account gets broken into, the cause is usually mundane. Attackers rarely need exotic tools: a password reused from another site and an account with no second factor waiting behind it will do. The gap between feeling secure and being secure is rarely about knowledge — it's about follow-through.

That's where a checklist earns its keep. "I should really improve my security" is a worry with no finish line. A checklist turns it into twelve concrete steps you can tick off, each one verifiable: done or not done. Vague anxiety becomes a finite task list, and finite tasks get finished.

Set your expectations now: this is a one-sitting job. With roughly an hour of focused time, you can work through all twelve steps in this article. Some take seconds, a few take longer, and a couple may send you hunting for a saved recovery code — but none require technical skill.

By the end, you'll know exactly which accounts are protected, which aren't, and what to fix first.

Step 1-3: Audit and Strengthen Your Passwords

Step 1: List Every Account That Matters

Open a note and write down the accounts you cannot afford to lose: your primary email first, then banking and payment apps, cloud storage, password manager, and phone carrier. Email comes first because anyone who controls it can reset the passwords to almost everything else.

Step 2: Get a Password Manager

A password manager generates and stores a long, unique password for every site, so you only memorize one master passphrase. Choose a reputable option, turn on its own two-factor authentication, and let it replace the sticky notes and browser autofill you may be relying on now.

Step 3: Retire Reused Passwords

Reused passwords are the single biggest weakness in this checklist. When any one site is breached, attackers try the same email-and-password combination everywhere else. Let the password manager's security report flag duplicates, then replace each one, starting with your email and financial accounts.

When creating replacements, length beats complexity. Four or five random words are easier to remember and far harder to crack than a short string of symbols.

Step 4-6: Turn On 2FA Everywhere It Counts

Start with your email account. Every password reset for every other service flows through it, so whoever controls your inbox can unlock everything else. If you enable 2FA on only one account, make it this one.

Step 4: Prioritise Your Email

Turn on 2FA for your primary email today, then work outward: banking, social media, cloud storage, work accounts. Most services keep the option under "security" or "sign-in" settings.

Step 5: Choose the Strongest Method Offered

Authenticator apps generate codes on your device, so they work offline and can't be intercepted in transit. Hardware security keys are harder to phish still. SMS codes beat nothing, but SIM-swap attacks can redirect them — treat text messages as the fallback, not the default.

Step 6: Save Your Backup Codes Properly

When a service shows backup codes, don't park them in your email drafts — that defeats the point. Print them or store them in a password manager's encrypted notes, somewhere you can reach without the account you're recovering.

Step 7-9: Lock Down Recovery Options

Recovery channels are the back door to your accounts. Anyone who controls your recovery email or phone can often reset your password and approve the reset themselves, which is why attackers go after them.

Step 7: Review Recovery Email and Phone

Start with your primary email account, then check banking, social media, and cloud storage. Confirm the listed recovery email and phone number are current, accessible only to you, and protected by 2FA themselves. If a recovery contact is wrong or missing, fix it before moving on.

Step 8: Remove Old Numbers and Abandoned Addresses

Delete anything outdated:

• Phone numbers from previous carriers, plans, or jobs
• Email addresses on domains you no longer control — an old address on a lapsed domain can be re-registered by anyone
• A partner's or family member's contact, if the arrangement has changed

Recycled phone numbers are a genuine risk: carriers reassign them, and the new owner may start receiving your reset codes.

Step 9: Rethink Security Questions

Treat answers like passwords, not facts. "Mother's maiden name" or "first pet" is often findable on social media. If the site lets you delete security questions entirely, do that. Otherwise, store invented answers in your password manager.

Step 10-11: Review Active Sessions and Connected Apps

Step 10: Sign Out Devices You Don't Recognise

Most major accounts (email, social media, cloud storage) show a list of active sessions: devices currently signed in, with approximate location and last activity date. Find this under security settings, often labelled "Devices" or "Where you're signed in".

Check each entry. Old phones, borrowed laptops and forgotten library logins all count. Sign out anything you don't recognise or no longer use, then change your password if a session looks suspicious.

Step 11: Revoke Third-Party App Access

Over the years, you've likely granted apps and services permission to access your accounts: sign in with Google, quiz apps, scheduling tools, old browser extensions. Each one is a standing invitation.

In your account's security settings, look for "Connected apps" or "Third-party access". Remove anything you don't actively use. If you can't remember what an app does, revoke it; you can always re-authorise later.

After Any Suspicious Alert

Repeat both checks immediately after any login alert you didn't expect. Attackers often create new sessions or app connections before you notice anything else.

Step 12: Make It a Habit

Security checklists only work if they stay current. An account created next year deserves the same protection as the ones you just fixed.

Add New Accounts Immediately

Every time you sign up for a new service, run the basics before you move on: a unique password from your manager, 2FA switched on, recovery details you control. It takes two minutes while the account is fresh, and it is far less painful than retrofitting later.

Re-Run the Checklist Twice a Year

Put a recurring reminder in your calendar — every six months, walk the full checklist again. Trigger it early when a breach headline involves a service you use: check that account first, change the password if needed, and confirm 2FA is still active.

Upgrade Your 2FA Over Time

Protection should grow with your habits. If you still receive codes by SMS, move to an authenticator app. Once that feels routine, consider a hardware security key for your most critical accounts — email, password manager, banking.

What to Do If a Step Reveals a Problem

Finding a weak spot isn't failure — it's the checklist working. Here's how to fix the most common discoveries.

Password or Session Red Flags

If a password is reused, weak, or you spot a session you don't recognise:

• Change the password immediately, starting with the email account tied to your other logins.
• Use the "sign out of all devices" option in the account's security settings, then sign back in fresh.
• Turn on 2FA if it wasn't already active.

Recovery or 2FA Set Up Wrong

If recovery details point to an old phone number or email, or 2FA was enrolled carelessly:

• Update your recovery options first, so you can't lock yourself out.
• Remove 2FA completely, then re-enrol it from scratch.
• Save the new backup codes somewhere safe and offline.

Suspicious Activity

Only warn contacts if there's real evidence of misuse — messages sent from your account or password resets you didn't request. Otherwise, there's no need to alarm anyone.

Small fixes done today beat a perfect plan done never.