SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-any-2sv

An account only offers text message codes for two-step verification. What does NCSC say?

Turn it on. Any type of 2SV is better than none.

Start playing free

  1. Turn it on, any 2SV beats none ✔
  2. Skip it, texts are unsafe
  3. Wait until hardware keys are offered

Why: Even a weaker second step stops most attacks that start with a stolen password. You can switch to a stronger method such as an authenticator app or passkey when it is available.

Huh, didn't know that: NCSC says 2SV keeps cyber criminals out of your accounts even if they know your passwords.

The dad joke
I clicked 'Accept All Cookies.' Now my browser won't stop craving chocolate chip.
Like this card?
Play the game

References

Answer: Turn it on, any 2SV beats none. Even a weaker second step stops most attacks that start with a stolen password. You can switch to a stronger method such as an authenticator app or passkey when it is available.

  1. NCSC: Secure your important online accounts www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/secure-your-important-online-accounts
    Any type of 2SV is better than none.
    Checked 2026-10-10.
  2. NCSC: Secure your email www.ncsc.gov.uk/collection/small-organisations-guide-to-cyber-security/secure-your-email
    keeps cyber criminals out of your accounts even if they know your passwords
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich sign-in method does CISA list as vulnerable to phishing?Security & PrivacyWhat does NCSC say to turn on to protect your online backups?Security & PrivacyIs a password enough?

That's stuff everyone should know.