You should have two-factor authentication on every financial account

Two factor authorization is something I have on every important account in my life.

Some social media sites require it, as people try to steal those all the time, and almost all financial accounts now require it. If you happen to have one that doesn't, you need to set it up right now.

While some accounts do have protections, like $50 on unauthorized charges on a credit card, many don't have immediate solutions. If someone breaks into your checking account and drains it, you don't get the cash back immediately upon reporting the theft.

It can take time and that will cause downstream problems.

The takeaway: Turn on two factor authentication on your financial accounts.

What is two-factor authentication?

Two-factor authentication, often shortened to 2FA or TFA, is when you're required to provide another layer of authentication in addition to your password (also, a password manager like 1Password can help too!). There are three main categories of authentication – something you know, something you have, and something you are.

If you use GMail, chances are you are familiar with how it works. When you try to log into your email, do you ever see the screen to the right? That's two factor authentication. They are confirming it's really you trying to access your account. That's 2FA.

At an ATM machine, your ATM card is something you have and your PIN is something you know. Adding a retina scan or fingerprint would be something you are. The “something you are” part, biometrics, is often left out because you can't change it easily if you have to. If the bank stores it and that information is stolen, you can't change something about you as easily as a password or an ATM card. 🙂

Why is this important? One factor authentication is less secure than two factor authentication because … well, two is more than one. 🙂

If you rely only on a username and password, you open yourself up to a lot of risk because that's all someone needs to get access to your account and wreck havoc on your finances.

With two factor authentication, in its most common form, you would get a text message with a PIN. When you log in, you have to provide that extra PIN to get access.

It's a minor inconvenience for you, it's a major inconvenience for someone looking to break into your account. They would need your phone too.

Is 2FA perfect? No – it's still possible to break into your account but it's made a little bit harder. A little bit harder means thieves might move onto the next account.

Check here to see if your financial institution offers it. Many will offer 2FA with a text message, phone call, email, or authenticator app. If your financial institution offers it, I recommend doing it.

And if you have the option, do not use text messages. Text messages are not encrypted or as secure as using an Authenticator app. Bloomberg discovered that a Swiss company got a million 2FA messages in June 2023 and while that alone isn't enough to cause problems, you can see how that's still not a good thing. I use the Google Authenticator app.

I went through this process years ago with Vanguard and the basic flow will be similar for any account.

Setting up Two-Factor Auth on Vanguard

Years ago, after confirming with twofactorauth.org and learning Vanguard offered 2FA, I set it up. Very easy.

To do it, log into your account and click on the My Accounts drop down in the top menu.

Then click on Security Code in the Security Profile section in the lower right.

You'll be prompted with a sign-up page followed by a Security Code Service Terms and Conditions page.

Next, you select your Phone Number and Contact Method (I chose Text).

You'll get a text with the six digit number and ten minutes to enter it before it expires.

Finally, set the rules for when to use 2FA – your choices are only one new computers or all the time.

I chose only when Vanguard doesn't recognize my computer or device.

There's a big NOTE on there that will have an impact on us – this added security breaks financial aggregators like Mint and Yodlee and I assumed it would break Personal Capital. I just logged in and unless I'm mistaken, Personal Capital was still able to updated as normal. Even if it didn't, it would have been unfortunate but security trumps convenience.

This isn't a perfect solution, there never will be, but it'll be one more layer of security. If nothing else, it's an early warning system too since you'll start getting text messages for login attempts you didn't make!

Remember to “Number Lock” Your Phone Number

Now that you have two-factor authorization, it's important to secure your phone. Many people use their phone for 2FA and thieves know this – so they may try to steal your phone number by porting it without your permission.

Fortunately, there's a simple solution – Number Lock (that's what Verizon, my carrier, calls it). By locking your number, it cannot be ported without you “unlocking” it first.

Here is the Verizon's FAQ answer explaining how it works:

What is a Number Lock?
If a scammer gets your personal information, they could transfer your mobile number to another carrier. This may be referred to as an unauthorized port out. Then, they could get your calls and texts to take control of other accounts, like banking and social media.

You can set up a Number Lock for free to protect your mobile number from an unauthorized transfer. Once a lock is set up for a number, that number cannot be ported to another line/carrier unless you remove the lock. You can set up a Number Lock with the My Verizon website and app or by calling Customer Service at *611.

This isn't usually turned on by default, so you'll have to log into your account and turn it on.