If someone gets into your email, they can usually reset the passwords for your mobile-money, bank, social-media and online-shop accounts. That is why email is the first account to protect. Two-step verification, sometimes called two-factor authentication, adds a second check: even if someone knows your password, they cannot sign in without a code or approval from your phone.
This guide walks through the general process. Menu names change over time, so use the steps as a map and follow what your provider shows you on screen.
Before you start
You will need:
- your phone, with the number linked to your email account, switched on and nearby;
- your current password, which should be unique to this account;
- a notebook or secure note for the recovery codes you will receive; and
- about fifteen minutes without interruptions.
Do not set this up on a computer you do not control, such as one in an internet café.
Step 1: Open your account security settings
Sign in to your email provider on a browser or in the official app. Look for a section called Security, Sign-in and security, or Password and security. Most providers keep this under your profile or account picture.
Step 2: Find two-step verification
Inside the security section, look for 2-Step Verification, Two-step verification or Two-factor authentication. Select it and follow the start prompt. The provider may ask you to confirm your password again.
Step 3: Choose your second step
Most providers offer one or more of these:
- A code sent by SMS to your phone number. This is simple and widely available.
- An authenticator app, which generates codes on your phone without using SMS.
- A prompt on a trusted device, where you approve sign-in on a phone you already use.
If you are unsure, start with the option you already use daily. A stronger option is an authenticator app, but any second step is better than none.
Step 4: Confirm the setup
Enter the code the provider sends you, or scan the setup code with your authenticator app and enter the code it shows. This proves the setup is working before the feature is switched on.
Step 5: Save your recovery codes
Once two-step verification is on, the provider will usually offer backup codes or recovery codes. These are single-use codes you can use if you lose your phone.
Save them somewhere safe, such as a printed copy in a locked drawer or a password manager. Do not send them in a message, email them to yourself or save them in a photo on your phone. Anyone with those codes, and your password, can sign in as you.
Step 6: Check your recovery options
While you are in the security section, check:
- the recovery phone number is one you still use and can access;
- the recovery email address, if you have one, is also secure; and
- there are no unfamiliar devices, apps or sign-in sessions listed.
Remove anything you do not recognise, and change your password if something looks wrong.
Step 7: Test the sign-in
Sign out completely. Then sign in again on your usual device and confirm the second step appears and works. Only after you have tested it should you consider the job finished.
Common mistakes
- Turning it on and forgetting the recovery codes. If you lose your phone, you may be locked out for days.
- Using an old phone number. If you changed numbers, update your security details first.
- Sharing the code. The code is for you. If someone else asks for it, that is a red flag, whoever they say they are.
- Ignoring prompts you did not start. If your phone asks you to approve a sign-in you did not request, decline it and change your password.
Protect the codes, not just the account
Two-step verification is powerful, but it depends on keeping the second step private. Never read a code out to anyone who contacted you first. The Bank of Ghana’s recent advisory made the same point for mobile-money and bank accounts: legitimate providers do not ask for codes by phone, text, email or social media.
Next steps for your business
Once your email is protected, do the same for your mobile-money and bank apps, your business social-media accounts and any online store or shared tool your team uses. Keep a short written list of which accounts are protected, who owns the recovery details, and where the recovery codes are stored.
If you would like help checking the set-up on your business email or phone, our Business IT team can give basic guidance during our approved service scope. We will not ask for your password, PIN or verification codes.
Recommended next step: set up your social media profiles properly
Protecting your accounts is only part of looking after your business online. Your Facebook and Instagram profiles also need to be set up clearly, so customers know what you offer, how to reach you and where to find you. E Light Services offers Get Social, a one-time Facebook Page and Instagram business-profile setup and optimisation at a flat GH₵500. The listed scope covers the bio, categories, action buttons, highlights, WhatsApp linking and starter content templates.
If you would like the wider picture, our digital-presence services include Google Business Profile, WhatsApp Business and business email, with starting prices on the digital-presence page.
Menu names and options are provider-specific and change over time. Follow your provider’s current instructions where they differ from this guide.