Authenticator Apps and Backups: Two Factor Authentication in Australia

Turn on two factor authentication now. Use an authenticator app or security key rather than SMS wherever an account offers it, and save your backup codes the moment you finish setup. This one change blocks most account takeover attempts, and the process takes less than ten minutes per account once you know the steps.

What you need before you start

A smooth two factor authentication setup depends on a few things being ready before you touch a single settings menu. Getting these sorted first means you won't be halfway through and stuck.

• Your account password and access to the email linked to that account
• A smartphone with a camera, since most authenticator apps register accounts by scanning a QR code
• A safe place to store backup codes, whether that's a printed sheet in a drawer or a password manager
• A decision on your primary second factor (an app, ideally) and at least one backup method

If it's a work account, check with your IT team first. Business Microsoft 365 or Google Workspace accounts are often managed centrally, and an admin may need to enable or approve mfa setup office 365 policies before you can register your own device.

Pro Tip: Do this setup on wi-fi at home, not on public wi-fi, and keep your phone nearby for the whole process, since most accounts want a code within a minute or two of generating it.

Step-by-step: set up an authenticator app (recommended approach)

An authenticator app is the method ACSC guidance points to as significantly more secure than SMS, and it works even when your phone has no signal. Here's the process for enabling mfa on most accounts, whether that's email, banking or Microsoft 365:

1. Install a reputable authenticator app on your phone, such as Microsoft Authenticator or Authy.
2. Open the account's security settings and look for "two-step verification" or "two factor authentication."
3. Choose "authenticator app" as your method when prompted.
4. Scan the QR code on screen with your app, or type in the secret key manually if scanning isn't an option.
5. Enter the six-digit code your app generates to confirm the link and finish setup.
6. Save the backup codes offered at this stage and add a second recovery method straight away.

A phishing-resistant alternative is emerging fast. Passkeys can replace passwords and one-time codes entirely on accounts that support them, and the ACSC recommends using passkeys or security keys where available.

This same flow applies whether you're doing a microsoft authenticator setup for a personal Outlook account or working through mfa setup office 365 for a work login. Microsoft's own guide walks through adding accounts to the app, and Google's 2-Step Verification page covers the same steps for a Gmail or Google Workspace login. Once you've done it for one account, the two factor login process for every other account follows the same pattern.

Setting up SMS codes and knowing their limits

SMS is better than nothing, but it's the weakest common option. Here's how to enable it and where it still makes sense.

• Go to security settings, choose "phone number" or "text message" as your method, and confirm the mobile number you enter with the code sent to it.
• Know the risk: SIM swap attacks and message interception mean SMS codes can be redirected to someone else's device.
• Use SMS mainly as a fallback for accounts that don't support an app or a key, or pair it with a stronger primary method rather than relying on it alone.
• Add a backup email address or secondary phone number so you're never locked out with only one recovery path.

If an account gives you the choice, an authenticator app should be your default and SMS your safety net, not the other way around.

If you lose your phone or replace it: transfer and recovery checklist

Losing a phone doesn't have to mean losing access to your accounts, but only if you plan ahead. ACSC guidance recommends transferring authenticator data before wiping an old device, rather than discovering the problem after the fact.

1. Before switching phones, open your authenticator app and use its transfer or export feature to move accounts to the new device.
2. If transfer isn't possible, log in using your saved backup codes, a registered backup phone, or a second security key if you've set one up.
3. If you're still locked out, contact the account's support team with your registered email, phone number and any previous backup codes on hand, since these details speed up verification.
4. Before disposing of the old phone, remove all authenticator accounts, sign out of everything, and factory reset the device.

Pro Tip: Test one backup code before you actually need it. Log out, use the code to log back in, then generate a fresh set, so you know the recovery path works when it matters.

Which method to choose: security trade-offs and recommended priorities

Not every account needs the same level of protection, but knowing the hierarchy helps you decide where to put the effort first.

• Security keys and passkeys sit at the top: ACSC guidance describes them as phishing-resistant, meaning even a convincing fake login page can't capture your credentials.
• Authenticator apps come next, generating codes locally on your device without relying on mobile networks.
• SMS and email codes sit at the bottom, useful as a fallback but the easiest for an attacker to intercept or redirect.

Prioritise your primary email account first, since it's usually the recovery path for everything else, followed by online banking and any government services you use. ACSC specifically calls out these three categories for the strongest available methods. Check each account's security settings to see if it supports passkeys or a physical key, and add one where it does. For everything else, an authenticator app is a sound, practical default.

PC Scientist: when to get professional help and what we do

Some of this is fiddly, especially transferring dozens of authenticator entries to a new phone or setting up a physical security key for the first time. Professional IT support services often include device setup and cybersecurity as part of their offerings.

A typical booking might involve safely transferring your authenticator app to a new handset, registering passkeys or security keys on your most important accounts, testing your backup codes before you need them, and building a recovery plan you can actually follow under pressure. Visits typically include clear upfront pricing and careful handling of privacy, so you know what you are paying and what is being touched on your devices.

What actually matters when you set this up

Most advice on two factor authentication focuses on getting it turned on, and stops there. That's the easy part. The part that actually prevents a bad day is the recovery plan: backup codes saved somewhere sensible, a second method registered, and a transfer process you understand before your phone is lost or broken, not after.

The conventional wisdom oversells SMS as "good enough" and undersells how often people skip the backup codes step entirely because the setup already feels finished. It isn't finished until you've saved those codes and tested at least one of them.

If you take one thing from this guide, prioritise your email account above everything else. It's the master key to almost every other account you own, and it deserves an authenticator app or a security key, not a text message.

- PC Scientist

Book PC Scientist for hands-on setup or recovery

If you'd rather have someone else handle the fiddly parts, that's exactly what we're here for. A visit from PC Scientist, onsite or remote, means you don't have to worry about getting a step wrong or locking yourself out halfway through.

• Device Setup Scientist: full setup of your phone, authenticator app and security keys, done properly the first time.
• Cybersecurity Scientist: account security reviews and MFA rollout for households and small businesses alike.
• Email Systems Scientist: securing your primary email account, the one that recovers everything else.

Book a visit through Device Setup Scientist or check out Cybersecurity Scientist to get your accounts properly protected before something goes wrong, not after.

Official guides and resources to follow next

For vendor-specific steps or formal advice beyond this guide, these pages are worth bookmarking.

• ACSC's multi-factor authentication guide for general MFA principles and setup advice
• ACSC's passkeys guide for phishing-resistant login options
• Microsoft's Authenticator setup guide for adding Microsoft accounts
• Google's 2-Step Verification page for Google account setup and backup codes

Sources

• Cyber
• Cyber
• Turn on 2-Step Verification - Computer - Google Account Help
• How to add your accounts to Microsoft Authenticator

Recommended

• Cybersecurity Scientist | Safer Devices NSW