After the Optus, Medibank, and Latitude breaches, cyber security has never been more relevant to everyday Australians. Two-factor authentication (2FA) is the single most effective way to protect your accounts — even if your password is stolen.
What Is Two-Factor Authentication?
Two-factor authentication means you need two things to log in:
- Something you know — your password
- Something you have — your phone or a hardware key
Even if a hacker steals your password in a breach, they still can’t get into your account without the second factor. It stops 99.9% of automated account takeover attempts.
Types of 2FA — Best to Worst
✅ Best: Authenticator App
Apps like Google Authenticator, Authy, or Microsoft Authenticator generate a 6-digit code that changes every 30 seconds. Even if someone intercepts your SMS messages, they can’t get in.
Use this for: email, banking (if supported), social media, any account with financial or personal data.
✅ Good: Hardware Key (YubiKey)
A physical USB key you plug in or tap. The most secure option. Overkill for most people but excellent for high-value accounts.
⚠️ Okay but vulnerable: SMS / Text Message
A code sent to your phone via SMS. Better than nothing, but vulnerable to SIM swapping — where someone convinces your carrier to transfer your number to their SIM. This is increasingly common in Australia following the Optus breach.
If SMS is the only option available, still use it. But upgrade to an authenticator app where possible.
❌ Avoid: Email-based 2FA
Codes sent to your email are only as secure as your email account itself. If your email is compromised, this provides no protection.
How to Set Up 2FA on Your Most Important Accounts
Gmail / Google Account
- Go to myaccount.google.com
- Security → 2-Step Verification
- Choose “Authenticator App” and follow prompts
Apple ID
- Settings → [Your Name] → Password & Security
- Turn on Two-Factor Authentication
Facebook / Instagram
- Settings → Security and Login → Two-Factor Authentication
- Choose “Authentication App”
Commonwealth Bank
NetBank uses CommBank Secure — automatic 2FA built into the app. Ensure you have the latest app version.
myGov
- Sign in → Account Settings → Digital Identity
- Set up SMS verification (authenticator apps not yet supported)
What to Do If You’ve Been Breached
If your email and password were in a breach, enabling 2FA is the most urgent step — even before changing your password. Check what accounts have been exposed: Free breach check →
The 10-Minute 2FA Setup Checklist
- ☐ Download Authy or Google Authenticator
- ☐ Enable 2FA on your primary email (Gmail, Outlook, Apple Mail)
- ☐ Enable 2FA on your bank’s app
- ☐ Enable 2FA on Facebook and Instagram
- ☐ Enable 2FA on your Apple ID or Google Account
- ☐ Save backup codes somewhere safe
10 minutes. Blocks almost all automated account compromise attacks.