Multi-factor authentication—MFA, sometimes called two-step or 2FA—is the second thing an account asks for after your password. A code, a tap, a little USB key. It's the single highest-value change most people can make to their online accounts, and it takes about two minutes per account.
Why it works at all
Passwords leak. Not usually because someone guessed yours, but because some company you signed up with years ago got broken into and the whole list walked out the door. That's the ordinary case, and it's why we keep pointing people at a password manager.
MFA changes what a leaked password is worth. Somebody with your email address and password sitting in a list still can't get in, because they don't have the second thing. That's the whole trick, and it's a good one.
The three kinds, weakest to strongest
Text message codes. Better than nothing, and we'd rather you use SMS than skip MFA entirely. The weakness is that phone numbers can be moved to someone else's phone by a persuasive person on a call with your carrier. Also, up here, a code that has to arrive over cell service is a code you might not get.
Authenticator apps. The rotating six-digit codes generated on your phone. No cell signal needed, nothing to intercept in transit, and it's free. This is the sweet spot for most people on most accounts.
Hardware keys. A physical key you plug in or tap. These are the only option that also resists a convincing fake login page, because the key checks what site it's actually talking to. Worth it for your email and your bank—your email especially, since that's the account that can reset all the others.
Where MFA doesn't help
It won't save you if you hand the code to someone. Fake login pages will ask for the password and the code, and a caller claiming to be your bank will ask you to read it aloud. Nobody legitimate ever needs your code. That's a firm rule with no exceptions.
It also doesn't cover accounts you forgot you had, or sessions already signed in on a stolen laptop.
Start with email, then banking, then anything holding a saved credit card. Use an authenticator app where you can. Passkeys are coming along as an even better answer—more on those another time.