Use it wherever the security account supports it
Two-factor authentication adds a second check after the password. It is especially important for the email, camera, alarm, smart-lock and monitoring accounts that can reveal or control your home.
Priority order: secure the recovery email first, then the primary security-system owner account, shared users, monitoring portal and connected smart-home platforms.
Choose the strongest practical method
| Method | Practical assessment |
|---|---|
| Passkey or hardware security key | Strong phishing resistance when genuinely supported by the provider and every required recovery route. |
| Authenticator app | Usually stronger than text messages and works without mobile reception; protect backups and recovery codes. |
| Push approval | Convenient, but read the prompt and reject unexpected requests. Repeated prompts may be an attack. |
| Text message | Still an improvement over password-only access, though phone-number takeover and delivery failure remain risks. |
| Email code | Only as strong as the email account, so secure that account first. |
Do not create a lockout trap
- Store recovery codes offline in a secure, retrievable place.
- Add a second trusted method or device where the provider allows it.
- Give household users their own logins and methods.
- Document how a trusted person can regain essential access during illness or phone loss.
- Remove old phones and numbers immediately.
- Test recovery before travel or changing mobile provider.
- Never approve a prompt you did not initiate.
What 2FA does not solve
It does not fix insecure shared links, over-broad family access, an already authorised device, weak recovery procedures, abandoned integrations or vulnerable firmware. Treat it as one layer, not a complete security programme.
Use it as part of the system
Prevent camera account takeover · Review all connected-camera access
Official reference: the UK NCSC recommends enabling two-step verification on smart devices where offered.
Last checked: 1 September 2026. Available methods and recovery processes vary by provider.