Most break-ins to private accounts do not start with a genius hacker but with a password that leaked, was guessed or was handed over by mistake. Two-step verification adds a layer: even if someone has your password, they need something else to get in, usually a code or approval from your phone. It is the simplest and most effective step you can take to protect your accounts, and it takes a few minutes.
WhatsApp. In Israel this is the most important account to protect, because a WhatsApp takeover lets scammers message all your contacts in your name asking for money. Go to Settings, choose Account, then Two-step verification, and set a six-digit PIN only you know. From now on, anyone trying to activate your account on another device will also need that PIN, not just the SMS code. Add a recovery email in case you forget the PIN.
Gmail and your Google account. Your Google account is usually the key to everything else: password resets for other sites go to it, and it holds your photos, contacts and YouTube channel if you have one. Go to Manage your Google Account, the Security tab, and turn on 2-Step Verification. Google will offer several methods; prefer approval via your phone or a passkey rather than SMS alone.
Instagram and Facebook. In Meta's Accounts Center, under Password and security, you can turn on two-factor authentication. Here an authenticator app such as Google Authenticator or Microsoft Authenticator, which generates a new code every 30 seconds, is recommended. Do not forget to save the backup codes the system gives you somewhere safe outside your phone.
Why not rely on SMS? Because SMS can be intercepted. Scammers can talk a mobile carrier into moving your number to a new SIM card, or simply talk you into reading them the code over the phone. An authenticator app or passkey protects better. And the most important rule: no real organization, not your bank, not WhatsApp, not Google, will ever ask you to read out a code you received. Anyone who asks is almost always a scammer.
