CyberThreats.au

Independent cybersecurity education

SearchScammed or hacked?Get help

For you

ScamsIs this a scam?

Types of scams

All scam guides

Practise

Protect yourselfMake my security checklist

Your devices

Everyday situations

Accounts and passwords

Privacy

All protect yourself guides
Cyber threats

Common threats

Newer and specialised threats

All cyber threat guides
Security products

Devices

Accounts and identity

Network and privacy

Backup

All product guides
Free checklists

For you

For work

All free checklists

For work

Small businessSmall business security checklist

Foundations

Payments, suppliers and incidents

All business guides

AI and cloud

All AI and cloud guides
Microsoft 365Microsoft 365 readiness checklist

Identity and access

Email

Teams, SharePoint and OneDrive

Data, devices and admin

All Microsoft 365 guides

Multi-factor Authentication Checklist

Check which important accounts have multi-factor authentication, with steps for each and a downloadable PDF.

Last reviewed 21 October 2026

12 questions. Answer as many as you like; your checklist updates as you go.

Most important accounts

Is multi-factor authentication (MFA) turned on for your main email account?

Why it matters: MFA asks for a second proof, such as a code from an app, as well as the password. The ACSC lists email first because a criminal with access to your email can reset the passwords for your other accounts.

How to do it
  1. Sign in to the email account and open its security or sign-in settings.
  2. Look for multi-factor authentication, two-factor authentication or 2-step verification, and turn it on.
  3. If choosing an authenticator app, install it, then scan the QR code shown in the account settings (or enter the key by hand).
  4. Enter the code the app shows to finish.
  5. Add a recovery method and save the backup codes, as the ACSC describes.

Based on the ACSC's multi-factor authentication guide, checked October 2026. Each email provider's help pages have the exact menu names.

Read our guide: How to secure your online accounts: where to startOfficial reference: ACSC: Protect yourself – Multi-factor authentication guide (PDF)

Is MFA turned on for online banking, and for shopping and payment accounts that store card details?

Why it matters: After email, the ACSC lists financial services and accounts that store payment details, such as shopping sites, as priorities for MFA, because they lead straight to money.

How to do it
  1. Open the bank's official app or type its web address yourself (not from a link in a message).
  2. Look in the security or sign-in settings for MFA, two-step or an in-app approval option.
  3. Turn on the strongest option offered.
  4. Repeat for shopping and payment accounts that keep card details.
  5. For accounts without MFA, the ACSC describes using a strong passphrase that isn't used anywhere else.

Based on the ACSC's multi-factor authentication guide, checked October 2026. Each bank's and shop's help pages have the exact steps.

Read our guide: How to secure your online accounts: where to startOfficial reference: ACSC: Protect yourself – Multi-factor authentication guide (PDF)

Is your myGov account protected with a passkey, Digital ID, an authenticator app or an SMS code, and have you completed its security review?

Why it matters: myGov is the sign-in for linked government services, and the ACSC lists it among accounts holding personal information. myGov describes passkeys and Digital ID as sign-in options, and says that if you use either, turning off the password stops criminals using stolen usernames and passwords.

How to do it
  1. Open the myGov app, or type my.gov.au into the browser yourself. myGov says not to sign in from links in emails, texts or social media messages.
  2. Sign in and check the sign-in settings and any security review actions shown.
  3. Choose a sign-in option: passkey, Digital ID, authenticator app, or SMS code.
  4. If using a passkey or Digital ID, myGov describes turning off the password as a sign-in option.
  5. Review the account history for sign-ins or changes you don't recognise.

Based on myGov's security guidance, checked October 2026. myGov's help pages have the latest steps.

Read our guide: How to secure your online accounts: where to startOfficial reference: myGov: How you can protect your myGov account

Other accounts

Is MFA turned on for your social media accounts?

Why it matters: A taken-over social media account can be used to message your contacts with scams. The ACSC lists social media among the accounts to protect with MFA.

How to do it
  1. Open the social media app and go to its settings.
  2. Find the security, password and security, or account centre section.
  3. Turn on two-factor authentication or 2-step verification.
  4. Choose an authenticator app if offered (the ACSC describes it as more secure than SMS).
  5. Save any backup codes the app offers.

Based on the ACSC's multi-factor authentication guide, checked October 2026. Each platform's help pages have the exact menu names.

Read our guide: How to secure your online accounts: where to startOfficial reference: ACSC: Protect yourself – Multi-factor authentication guide (PDF)

Is MFA on for the accounts behind your devices and cloud storage, such as your Apple, Google or Microsoft account?

Why it matters: Device accounts often control cloud storage, backups and find-my-device features. The ACSC's guide lists Apple, Microsoft and Google accounts among its examples of accounts to protect with MFA.

How to do it
  1. Open the account's security settings (on the device, or on the provider's account website).
  2. Check whether two-factor authentication or 2-step verification is on.
  3. If it's off, turn it on and follow the prompts.
  4. Check the recovery phone number and email are current.

Based on the ACSC's multi-factor authentication guide, checked October 2026. Apple's, Google's and Microsoft's help pages have the exact steps.

Read our guide: How to secure your online accounts: where to startOfficial reference: ACSC: Protect yourself – Multi-factor authentication guide (PDF)

If you use a password manager, is MFA turned on for it?

Why it matters: A password manager holds every other password, which the ACSC notes makes password managers attractive targets for criminals. The ACSC describes using MFA on a password manager where available, together with a strong master passphrase.

How to do it
  1. Open the password manager's settings or its account website.
  2. Find the two-factor or multi-factor authentication option and turn it on.
  3. Use a strong, unique master passphrase that isn't saved in a web browser.
  4. Set devices to lock after a short idle time. The ACSC gives 5 minutes as an example.

Based on the ACSC's password manager guidance, checked October 2026. Each password manager's help pages have the exact steps.

Read our guide: How to secure your online accounts: where to startOfficial reference: ACSC: Password managers

Is MFA turned on for work or business accounts you use, such as email, cloud services and remote access?

Why it matters: Work accounts can reach business email, files and payments. The ACSC's small business guide says to turn on MFA wherever possible, starting with the most important accounts.

How to do it
  1. List the business accounts in use: email, file storage, accounting, banking and any remote access.
  2. Check each one's security settings for MFA.
  3. Turn it on, starting with the most important accounts.
  4. For accounts an employer manages, its IT team or provider sets the options.

Based on the ACSC's small business cyber security guide, checked October 2026.

Read our guide: Microsoft 365 MFA methods compared, from SMS to passkeysOfficial reference: ACSC: Small business cyber security guide (PDF)

Methods

Where an account offers it, do you use an authenticator app rather than SMS codes?

Why it matters: The ACSC describes authenticator apps as more secure than receiving a code by SMS. An authenticator app makes a new code at regular intervals, linked to the account by scanning a QR code.

How to do it
  1. Install an authenticator app from the official app store.
  2. In the account's security settings, choose the authenticator app option.
  3. Scan the QR code with the app, or enter the key shown.
  4. Enter the code from the app to confirm.
  5. Save the backup codes the account offers.

Based on the ACSC's multi-factor authentication guide, checked October 2026.

Read our guide: Microsoft 365 MFA methods compared, from SMS to passkeysOfficial reference: ACSC: Protect yourself – Multi-factor authentication guide (PDF)

Have you considered a physical security key for your most important accounts?

Why it matters: The ACSC describes a security key as a more secure form of MFA than codes by SMS or from an app. It's a physical device that has to be present to sign in.

How to do it
  1. Check whether the account supports security keys (often listed as security key, hardware key or FIDO).
  2. Add the key in the account's security settings and follow the prompts.
  3. Register a second key, or keep another sign-in method, in case one is lost.
  4. Store the spare key somewhere safe.

Based on the ACSC's multi-factor authentication guide and myGov's passkey help (which describes creating more than one passkey when using a security key), checked October 2026.

Read our guide: Hardware security keys: what they are and how they differOfficial reference: myGov: Use passkeys

Do you use passkeys for accounts that offer them?

Why it matters: eSafety's Be Connected describes a passkey as a unique digital key that your device creates and stores securely; it never leaves the device, and your fingerprint, face or PIN confirms it's you. myGov describes passkeys as a more secure alternative to passwords.

How to do it
  1. Check the account's sign-in or security settings for a passkey option.
  2. For myGov: sign in, select My account or Menu, then Account settings, then Manage under Passkeys, and select Create passkey.
  3. Follow the device's prompts to confirm with a fingerprint, face or PIN.
  4. Create passkeys only on a trusted device you own and don't share, as myGov describes.
  5. Passkeys can sync through Apple Keychain, Google Password Manager or some password managers, which Be Connected notes helps when moving to a new device.

Based on myGov's passkey help and eSafety's Be Connected, checked October 2026. Each service's help pages have its own steps.

Read our guide: Passkeys explained: what they are and how they workOfficial reference: eSafety Be Connected: What is a passkey?

Getting back in

Have you saved backup codes and set up a recovery method for your important accounts?

Why it matters: If the authenticator app is deleted or the phone is lost, backup codes and recovery details are the way back in. The ACSC describes saving backup codes, and keeping recovery methods as secure as the main ones and up to date.

How to do it
  1. In each important account's security settings, look for backup or recovery codes.
  2. Save them somewhere safe and separate from the phone, such as printed and stored securely.
  3. Check the recovery email address and phone number are current.
  4. Protect the recovery email account with MFA too.

Based on the ACSC's multi-factor authentication guide, checked October 2026.

Read our guide: Planning account recovery before you need itOfficial reference: ACSC: Protect yourself – Multi-factor authentication guide (PDF)

Do you know what you'd do about MFA if your phone were replaced, lost or your number changed?

Why it matters: MFA codes are often tied to one phone or one phone number. The ACSC describes moving the authenticator app to the new device before resetting the old one, and updating SMS sign-in numbers before losing access to an old number.

How to do it
  1. Before resetting or disposing of an old phone, move the authenticator app to the new phone, as the ACSC describes.
  2. Before changing phone numbers, update the number on every account that sends SMS codes.
  3. Keep backup codes somewhere other than the phone, so a lost phone isn't a locked-out account.
  4. Never approve a sign-in prompt you didn't start, and never share an MFA code. The ACSC lists both as security tips.

Based on the ACSC's multi-factor authentication guide, checked October 2026.

Read our guide: Planning account recovery before you need itOfficial reference: ACSC: Protect yourself – Multi-factor authentication guide (PDF)

Your checklist

Answer the questions above. Your checklist updates as you go.

General information based on official guidance and makers’ instructions, not advice about your situation.

Sources