# A second sign-in step helps. Some kinds help much more. Staying a step ahead · 02 · 12 min read Texted codes, authenticator apps, approval prompts, and passkeys do not protect an account in the same way. The important difference is whether a sign-in secret can be copied and used somewhere else. This page helps you: - Compare texted codes, authenticator apps, prompts, and passkeys - See why a passkey only works on its own service - Decide which accounts to protect first A password is one factor: something you know. A second factor usually proves that you control an authenticator, such as a phone or security key. A face, fingerprint, or device PIN may unlock that authenticator locally, but the biometric is not a standalone remote authenticator. Texted and app-generated codes are normally added after a password. A passkey works differently: many services use it to replace the password. In either case, the useful question is what an impostor could copy and use from somewhere else. ## Each sign-in method moves the weak point. Choose an option to see what changes and what still deserves attention. A service may offer only some of these methods, and its account-recovery route matters as much as the everyday sign-in. ### Password only Primary sign-in A unique password keeps one service’s breach from opening this account too. The password is still the whole sign-in. - **Relies on your phone number?** Not for sign-in, although the reset route may still use one. - **Can a fake site reuse it?** Yes. A lookalike page can collect the password and replay it at the real service. - **Bound to the real service?** No. The same characters can be entered on another site. - **Recovery question to ask:** Review the email address, phone number, or support process that can reset it. ### Texted codes (SMS) Second step A leaked password by itself is no longer enough. Texts are useful when they are the second step a service offers, but they still depend on the security of the phone number. - **Relies on your phone number?** Yes. A carrier-account takeover or number transfer can redirect the code. - **Can a fake site reuse it?** Yes. A lookalike page can ask for the current code and relay it immediately. - **Bound to the real service?** No. The digits are not tied to the site where they are entered. - **Recovery question to ask:** Protect the carrier account and check which fallback method the service keeps. ### Authenticator code Second step The code does not travel through your phone number, so moving that number is not enough. The current code can still be phished. - **Relies on your phone number?** Not for each code. The app creates it on the enrolled device. - **Can a fake site reuse it?** Yes. A lookalike page can ask for the current app code and relay it. - **Bound to the real service?** No. A manually entered one-time code is not bound to the site. - **Recovery question to ask:** Check the app’s transfer or backup behavior before replacing the device. ### Tap-to-approve prompt Second step Denying a request you did not start can stop a password-only sign-in. Repeated prompts can make a mistaken approval feel routine. - **Relies on your phone number?** Usually no. The prompt goes to an enrolled app or device. - **Can a fake site reuse it?** A fake sign-in can trigger a real prompt. An accidental approval may complete the attacker’s sign-in. - **Bound to the real service?** Not necessarily. A simple approve or deny prompt may show little sign-in context. - **Recovery question to ask:** Review enrolled devices and the service’s fallback method. ### Number-matching prompt Second step The sign-in shows a number that must be matched in the app. This reduces accidental approvals and push fatigue, but it is not phishing-resistant. - **Relies on your phone number?** Usually no. The prompt goes to an enrolled app or device. - **Can a fake site reuse it?** It makes blind approval harder, but a convincing relay can still ask you to match the attacker’s sign-in. - **Bound to the real service?** No. Matching a number adds context, but it does not cryptographically bind the sign-in to a site. - **Recovery question to ask:** Review enrolled devices and the service’s fallback method. ### FIDO security key Second step or passwordless A FIDO security key is phishing-resistant. A service may use it after a password or as a passwordless credential. - **Relies on your phone number?** No. - **Can a fake site reuse it?** No, when the service uses a FIDO security key. The key will not authenticate to the wrong site. - **Bound to the real service?** Yes. The cryptographic response is bound to the real service. - **Recovery question to ask:** Register a spare method or key if the service allows it, then store it separately. ### Passkey Password replacement A passkey is phishing-resistant and usually replaces the password. It may sync across devices or stay bound to one device or security key. - **Relies on your phone number?** No. A nearby phone may help with cross-device sign-in, but the number is not the credential. - **Can a fake site reuse it?** No. A passkey for one service cannot authenticate to a lookalike site. - **Bound to the real service?** Yes. The cryptographic credential is created for the real service. - **Recovery question to ask:** Learn whether it syncs through a provider, stays on one device, or relies on another account-recovery route. ## One rule for tap-to-approve Approve a sign-in only when you started it yourself. When a service sends a “was this you?” prompt to your phone, you need to check that you began the sign-in. If someone already has your password, they may trigger the prompt repeatedly and hope you tap yes to make the buzzing stop. This is called MFA fatigue. Some prompts ask you to match a number shown on the sign-in screen. Number matching makes a blind approval harder, but it is not phishing-resistant. Match the number only when you just started that sign-in. CISA describes it as an interim protection when a service cannot offer a phishing-resistant method. [Read CISA's number-matching guidance](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf). If a prompt appears when you were not trying to sign in, deny it. An unexpected prompt can mean someone tried your password, so open the service through a trusted route, review recent activity, and change the password if the service advises it. You can also check your [accounts caught in a breach](https://explained.withpersona.com/your-identity-online/data-breaches). **When a “was this you?” prompt appears** Did you start this sign-in yourself? - **Yes, I just started it:** Approve it. If it shows a number, match the one on your sign-in screen. - **No:** Deny it. Open the service through a trusted route, review recent activity, and change the password if the service advises it. ## A passkey belongs to one service A passkey replaces the password on many services. It uses a cryptographic credential created for that service. You may approve its use with the face, fingerprint, or device PIN that unlocks your device, but the service does not receive that biometric or PIN. Because the credential is bound to the service, a lookalike sign-in page cannot use it for the real account. The site-specific credential is what makes passkeys phishing-resistant. A fake login page can collect a password or texted code. A correctly implemented passkey does not authenticate to a different site. **What a fake sign-in page can take** - **A password.** Safe on a fake sign-in page? No. A fake page can collect it. What the real service receives: The password itself - **A texted code.** Safe on a fake sign-in page? No. A fake page can collect it. What the real service receives: The code itself - **A passkey.** Safe on a fake sign-in page? Yes, when correctly implemented. It does not authenticate to a different site. What the real service receives: A credential made for that service. Never your face, fingerprint, or device PIN. Some passkeys sync through a provider account, while others stay on one device or a physical security key. That changes what happens when you replace a phone. The service may also keep another recovery route, such as a code, recovery contact, or identity check. A phishing-resistant sign-in does not make a weaker recovery route disappear, so review both before relying on a single device. Reviewed July 2026. Technical references: [FIDO Alliance passkey overview](https://fidoalliance.org/passkeys/) and [NIST authentication guidance](https://pages.nist.gov/800-63-4/sp800-63b.html). CISA describes phishing-resistant methods, such as security keys and passkeys, as the most secure form of multi-factor authentication in its [phishing-resistant sign-in fact sheet](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf). ## If the phone is gone “What if I lose the phone that has my second factor?” Before a loss, save any recovery codes the service offers, register another authenticator where possible, and keep recovery details current. If the phone is already gone, try another enrolled authenticator or a saved code, then use the service’s official account-recovery path. Contact the carrier as well if the phone or number was lost or stolen. ## Before you switch phones Moving to a new phone is the moment authenticator codes get left behind. Texted codes usually follow the phone number after the carrier moves it. Authenticator-app codes may stay on the old device unless that app supports a backup or transfer. Check the app and each important service before wiping the old phone. Before you switch, use the authenticator app’s documented backup or transfer if it offers one. Save each service’s recovery codes somewhere you can reach without the old phone, such as your [password manager](https://explained.withpersona.com/your-identity-online/password-managers). Keep a password manager's own recovery code somewhere you can reach without opening that vault. Confirm that you can sign in on the new phone before erasing the old one. ## Start with the accounts that can reset or reach the rest. Tick the ones you have reviewed. Your own order may differ, especially if another account can reset passwords, move money, or speak as you. - **Email:** Can reset many other accounts - **Phone / carrier account:** Protects the number your codes arrive on - **Bank & payment apps:** Can approve payments or move money - **Password manager:** The vault holding all the others - **Main social & shopping:** Can speak as you or store payment details Start with email if it can reset the other accounts you use. Add the next account when you can, starting with one that can reset the others. Keep going with any account that can reset another one or reach money. That covers this list. Review any other account that can reset a password, move money, or speak as you. ## Services hide the setting under different names Menu names differ by service, but many place these controls in a security or sign-in area. Use the service’s help page if the path below does not match. 1. Open the account’s Settings, then look for a section called Security, Password & security, or Sign-in. 2. Find the item labeled Two-factor, Two-step verification, or 2FA, and choose to turn it on. 3. For a second factor, choose an authenticator app or security key over texts where the service supports one, then save the recovery codes it shows you. A passkey may appear separately because it can replace the password. ## Before you leave the settings page 1. Start with email if it can reset your other accounts. Review both its sign-in method and its recovery path before working outward. 2. For a second factor, prefer an authenticator app or security key over texted codes where the service offers the choice. If it offers a passkey, that may replace the password instead. Texts can be a starting point, but a SIM swap can redirect them. More on that in [your phone & accounts](https://explained.withpersona.com/your-identity-online/phone-and-accounts). 3. Save your backup codes the day you turn it on, before you ever need them. Your [password manager](https://explained.withpersona.com/your-identity-online/password-managers) is a good place to keep them, except for that password manager's own recovery code. Keep that one somewhere you can reach without the vault. --- _Part of Identity Explained (by Persona). https://explained.withpersona.com/your-identity-online/two-factor_