Enable two-factor authentication on email, payment, and social accounts; prioritize phone pop-ups over SMS codes

No cost involved. Each account takes just two to three minutes to set up once.

Google studied 350,000 real account-takeover attempts, also called account hijacking. One category used a device, such as a confirmation prompt on a phone or a hardware security key. These methods blocked more than 94% of phishing-based hijacking attempts and 100% of automated attempts. Phishing tricks you into entering a password on a fake website; automated attacks try leaked passwords in bulk. Another category asked questions, such as where you last signed in or what your backup email was. These methods blocked as little as 10% of phishing-based attempts and 73% of automated attempts. Among device-based methods, SMS codes were weaker than phone prompts: phishing attackers successfully answered 4% of SMS challenges but only 1% of phone prompts. For attacks specifically targeting an individual, SMS blocked only 76%, while phone prompts blocked 90%.

Doerfler P, Thomas K, Marincenko M, et al. (2019). Evaluating Login Challenges as a Defense Against Account Takeover. The World Wide Web Conference (WWW '19). https://doi.org/10.1145/3308558.3313481

The same study also found that these verification methods occasionally block legitimate users from accessing their accounts. 52% of real users failed to log in on their first try. However, 97% of them eventually gained access. It is recommended to enable this feature on email accounts first, as most other accounts allow password recovery via email. Keep verification codes to yourself; what happens if you read them aloud for someone else is in Section 8, item 45 (reading verification codes).