Two-step sign-in for bank and payment accounts

Why money accounts need a second lock, which option to choose, and why you must never share the code.

⏱ 6 min read · ▶ 1:11 video
The short version

Two-step sign-in means your bank or payment app asks for something extra (a code, a tap or your face) after your password. Even if a scammer steals your password, they still can’t get in. The catch: scammers try to trick you into reading them the code, so never share it with anyone.

📅 Checked as of October 2026. Apps and rules change, so check the sources below if something looks different.

⚠️ Never share a sign-in code. Ever.

Not with someone saying they’re from your bank, Zelle, PayPal, Amazon, the IRS, the police or “fraud prevention”, and not with a relative who calls in a panic. The FTC’s advice: no matter the story, don’t share a verification code with someone you didn’t contact first. If someone asks, hang up and call the number on your card.

Your options, from good to best

  • Text message (SMS) code: much better than nothing. It can be stolen by a SIM swap, so ask your mobile carrier for a port-out PIN or SIM lock.
  • Authenticator app or in-app approval: a code or “Is this you?” prompt in an app on your phone. Stronger than texts.
  • Passkey: sign in with your face, fingerprint or phone PIN. The strongest option, and it can’t be phished. A growing number of banks and PayPal support them. See passwords, passkeys and 2FA.

Use the strongest one your bank offers. Many banks only offer text codes; that’s still worth turning on.

Think of it like this: your password is the key to the front door; two-step is the deadbolt that only opens from your phone. A thief with a copied key still can’t get in, unless you open the deadbolt for them.

Backup codes: your spare key

Many accounts give you backup codes: a short list of one-time codes for when you lose your phone. Each works once.

  • Print them or write them down, and keep them with important papers.
  • Or save them in your password manager, under that account.
  • Don’t keep them as a photo in your camera roll or in email.
  • If you used one, or think someone saw them, make a new set.

Accounts to do first

  1. Your email (password resets go there)
  2. Your bank and credit cards
  3. Payment apps: PayPal, Venmo, Cash App (and Zelle through your bank)
  4. Your mobile carrier account (to block SIM swaps)
  5. Investment and retirement accounts

Step-by-step: how to turn on two-step verification.

If you shared a code by mistake

  1. Call your bank or the app right away (number on your card or in the official app).
  2. Change your password and sign out all other devices.
  3. Check recent transactions and report fraud at ReportFraud.ftc.gov.

Quick tips

  • Turn on two-step for your email and bank this week.
  • Store backup codes somewhere safe, offline or in a password manager.
  • Ask your mobile carrier about a SIM lock or port-out PIN.
  • Read what phishing is and payment app scams so you know the tricks.

Sources

Test yourself: play Password Strength Challenge or Scam or Legit?, quick free games.

🛠️ Try it step by step

More in our How-To guides.

📖 Words to know

2FA / MFA Authenticator app Passkey Backup codes SIM swap