Turn on a second step for sign-in
With multifactor authentication, a stolen password is not enough. Some second steps resist phishing better than others.
What the second step changes
Multifactor authentication asks for something besides the password: a code from an app, a prompt on your phone, a fingerprint, or a small security key. Someone who has only your password is stopped at this step.
Turn it on first for email. Whoever controls your mailbox can reset the password for almost everything else.
Which method to choose
Passkeys and security keys are the strongest option, because they work only on the real site and cannot be typed into a fake one. An authenticator app is the next best. Codes by text message are the weakest, yet still much better than a password alone.
Use the strongest method each service offers, and do not wait for a perfect one.
Prompts you did not ask for
If your phone shows a sign-in request while you are not signing in, someone else has your password. Decline the request, change the password and tell your IT team.
Attackers sometimes send request after request, hoping you approve one to make them stop. Nobody from support will ever ask you to approve a prompt or read out a code.
This note is our own plain-language summary. For the full guidance, read the original: https://www.cisa.gov/secure-our-world/turn-mfa
An unexpected prompt means your password is already known.