My Parents Are Aging
Menu

Two-Factor Authentication for Parents: The Setup That Sticks

A password alone is something a scammer can buy, guess, or trick out of anyone. Two-factor authentication adds a second step that only your parent has: a code on their phone, for example. It is the single most effective thing you can turn on for them, and with the right order and the right conversation it can be done in one sitting.

Last reviewed August 2026 Reading time: 6 minutes

the second step protects the accounts

The two-factor setup order

Two-factor matters more for parents than for anyone else, because their accounts are the keys to the family's money. The setup order protects what matters first.

  1. 1. ChooseThe second step that fitsText codes are easiest, authenticator apps are safer, and passkeys are the strongest: pick what the parent will actually use.
  2. 2. OrderEmail first, then moneyThe email account resets everything else, so it gets two-factor first, then the bank, then the phone account.
  3. 3. BackupThe recovery codesRecovery codes go in the family vault so a lost phone does not lock the family out.
  4. 4. The drillDo it together onceSign in together so the parent learns the flow without feeling managed, per the teaching guide.

The rule, in one sentence: the password is something a scammer could learn; the second step is something only your parent has. Turn on the second step for the accounts that matter, in this order: email first, then the phone account, then the bank.

Why this matters more for your parents than for you

Most account takeovers do not involve clever hacking. They involve passwords that were reused, leaked, or tricked out of someone. Older adults are targeted because they are more likely to reuse one password across accounts and more likely to hand over a code when asked politely. Two-factor authentication breaks the chain: even if a scammer has the password, the second step stops them.

It also breaks the most dangerous phone scam of the moment. The scammer calls, claims to be from the bank, and asks your parent to read back the code that was just texted to them. With two-factor on, that code is the last lock on the account, so the scammer is really asking your parent to hand over the key. Your parent needs one rule for that moment, and it is in the script below.

The three ways to do the second step

Not all second steps are equal, and the best one for a parent is the one they will actually use.

  • A code sent by text. The easiest to set up and the easiest to explain: "a code arrives, you type it in." It is the weakest of the three because a phone number can be redirected by a determined scammer, but it is still a massive improvement over a password alone. Start here.
  • An authenticator app. Stronger, because the code lives on the device itself and never travels over text. The catch: the app must be installed and the parent must get used to opening it. Good for a parent who is comfortable with their phone, overkill for one who is not.
  • A security key. The strongest option: a small device you plug in or tap. It requires no code at all, but it costs money, and if the key is lost, recovery is harder. Rarely worth it for most parents. Mention it only if your parent is unusually technical.

Recommendation: text codes to start, for every account. If your parent picks it up quickly and wants "the stronger one," move them to an authenticator app later. Do not let the perfect be the enemy of the done.

The setup order that protects what matters

Set up in this order, and stop when the parent is tired. Partial is fine: three protected accounts beat ten half-done ones.

  1. Email first, always. Email is the master key. Every "forgot your password" link goes there, so the account that can reset all others must be protected first. If your parent uses Gmail, Apple Mail, or Outlook, this is the Google, Apple, or Microsoft account settings.
  2. The phone account (Apple ID or Google account on their phone). Their phone is where the codes arrive, so the account tied to it is the backbone of everything else. Protect it second.
  3. The bank and any card apps. This is where the money is, and banks all support two-factor now. If the parent does online banking, turn it on here.
  4. Everything else when there is time: social media, the pharmacy app, the insurance portal, the utility account. Each one is a smaller win, but they add up.

How to do it without making them feel managed

Consent first, always. This is their life and their accounts. The framing that works: "This is the one thing that stops the scammers cold. Can we turn it on together? It takes five minutes and then it's done."

  • Do it together, on their device, with them driving. You talk, they tap. If you take over the phone, they don't learn the pattern and feel managed. If they drive, they learn the pattern and can do the next account themselves.
  • One account per sitting. Two-factor setup involves reading a code and typing it somewhere. That is real effort for someone who is not used to it. Stop while it still feels easy, and do the next one tomorrow.
  • Write down the backup codes. Every provider gives recovery codes when you turn on two-factor ("write these down and keep them safe"). This is not optional. Print them, put them in the family password vault, and tell the parent where they live.
  • Agree on the one rule. "A code is only for you. You type it in yourself, when you asked for it. If someone asks you to read a code out loud, hang up. It is always a scam."

What to do when a code does not arrive

This is the moment parents get scared, and it is worth planning for before it happens:

  • Phone off or no signal? The backup codes are the answer. That is why they live in the vault, printed.
  • New phone? Log in with the backup code once, then set the new phone up as the code receiver. Do this while the old phone still works, if possible.
  • Codes stop arriving out of nowhere? That is a red flag, not a coincidence. If your parent suddenly stops getting codes, check the phone account for changes before assuming a glitch. See Your parent's account was hacked: the 60-minute response.

The script to teach a parent

Print this and put it by the phone. Short enough to actually get used:

Codes and you: 1. A code is only for you. You type it in yourself. 2. You type it only when YOU asked for it. 3. If anyone asks you to read a code out loud, or to text it back: hang up. It is always a scam. 4. No real bank, company, or agency ever asks for your code.

Related

Sources

Found an error? Report it.

The next thing your family needs

Digital spring cleaning: simplifying a parent's online life

Also relevant: