Apple ID two-factor authentication: how it works and how to turn it on

MaciPhoneUpdated

Two-factor authentication is an extra layer of security for your Apple Account. Apple says it's designed so you're the only one who can get into the account, even if someone knows your password. Signing in on a new device or on the web then needs your password and a six-digit verification code.

Quick answer

Apple's two-factor authentication asks for your password and a six-digit code when you sign in on a new device or the web. The code appears on a trusted device or is sent to a trusted phone number. To turn it on, go to Settings > [your name] > Sign-In & Security on iPhone, or System Settings > [your name] > Sign-In & Security on a Mac.

What is two-factor authentication on an Apple Account?

It's a second check on top of your password. When you sign in somewhere new, Apple shows a code on a device you've already signed in on, or sends one to your phone number, and you type it in. Apple says it's the default for most accounts and is required for services such as Apple Pay and Sign in with Apple.

Apple says "Apple ID is now Apple Account", with the same email address or phone number and password, so Apple ID two-factor authentication is the same thing.

What are trusted devices and trusted phone numbers?

A trusted device, in Apple's words, is an iPhone, iPad, Apple Watch, Apple Vision Pro or Mac where you've already signed in to your Apple Account with two-factor authentication. It shows verification codes when you sign in elsewhere, and approves critical changes such as a password change.

A trusted phone number is where codes go by text or call. You need at least one. Apple suggests a second number that isn't tied to your iPhone: if your iPhone is your only trusted device and the only way to reach your number, losing it could lock you out.

To add a number on iPhone, open Settings, tap [your name], then Sign-In & Security > Two-Factor Authentication, and tap Add Trusted Phone Number below the list of devices and numbers. On a Mac, the same button is at the bottom of that screen in System Settings.

Checking the devices on your account and removing ones you don't know is covered in is someone else signed in to your account?

How do Apple verification codes work?

When you sign in on a new device or browser, a sign-in notification appears on your trusted devices. Choose Allow to see the code, then type it on the new device. The notification can include a map, but Apple says the location is approximate, based on the new device's IP address.

If no trusted device is nearby, select "Didn't get a code?" or "Can't get to your devices?" and have the code sent to your trusted number as a text or a call. Apple notes texted codes can land in the Unknown Senders section of Messages.

How do you turn on two-factor authentication on iPhone and Mac?

On most accounts it's already on. If yours isn't, these are Apple's steps.

On iPhone:

  1. Open Settings, tap [your name], then tap Sign-In & Security.
  2. Tap Two-Factor Authentication.
  3. Enter a trusted phone number and choose a text message or an automated phone call.
  4. Tap Next, then enter the code sent to that number.

On a Mac:

  1. Choose Apple menu > System Settings, click [your name], then click Sign-In & Security.
  2. Click Turn on Two-Factor Authentication, entering your Apple Account password if asked.
  3. Answer your security questions and click Continue.
  4. Enter your phone number, choose how to get codes, and click Continue.
  5. Enter the six-digit code sent to your trusted phone number.

Apple says you can turn it off only within two weeks of turning it on, and that an account created with two-factor authentication can't have it removed.

What are Security Keys for Apple Account?

They're an optional extra Apple offers for people who want more defence against phishing and social engineering. A security key is a small physical device that confirms it's you at sign-in. With keys on, signing in on a new device or the web takes your password plus a key or another trusted Apple device, and the same is needed to reset your password.

Apple asks for at least two FIDO Certified keys, and iOS 16.3 or macOS Ventura 13.2 or later on every device you're signed in on. Child accounts and Managed Apple Accounts aren't supported. Apple's warning is plain: lose all your keys and trusted devices and you could be locked out permanently.

You add them from the Two-Factor Authentication screen under Sign-In & Security.

What should you do with a verification code you didn't ask for?

Don't share it. Apple lists a two-factor code you didn't request as a sign your account may be compromised. Apple says it will never ask for your password, device passcode or two-factor authentication code, and its scam guidance says never to enter codes on a web page someone directs you to.

If a sign-in notification appears that you didn't start, select Don't Allow. Apple's personal safety guide suggests a screenshot first. Then change your Apple Account password, and at account.apple.com correct any details and remove any devices you don't recognise. Apple also says to check with your mobile network that SMS forwarding isn't set up on your number. If you can't sign in, start account recovery at iforgot.apple.com.

Where Failshot fits

Apple's two-factor pages are about signing in on new devices and the web, not someone who unlocks your Mac in person. That's the case Failshot is for.

Your password is the first layer. Failshot is the second: while it's on, it photographs whoever unlocks your Mac, then, with Pro, records a 5-second video (on by default, and it can be switched off). With the Mac's built-in camera, the green light comes on, and Failshot's window tells whoever unlocked it that the unlock was photographed. Photos, and Pro videos, are kept on your Mac, and leave it only in Pro email alerts and the encrypted web vault, if you turn those on.

Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

Failshot for iPhone is coming soon. Failshot for Mac is a free download for macOS 14 or later, and it's for your own devices. Free to use. Pro adds video, email alerts and the encrypted vault. Try Failshot Pro free for 7 days. Your card is taken at sign-up and charged on day 8 unless you cancel.

More questions

Is two-factor authentication the same as two-step verification?

The UK's National Cyber Security Centre calls it 2-step verification, or 2SV, and says it's also known as two-factor authentication. It says turning it on "is one of the most effective ways to protect your online accounts from cyber criminals".

Can I turn off two-factor authentication on my Apple Account?

Only within two weeks of turning it on, Apple says, using the link in your confirmation email. After that it stays on. If your account was created with two-factor authentication, it can't be removed at all.

What if I can't get an Apple verification code?

If you're only away from your devices and number for a while, Apple suggests waiting a few days, then signing in. If they're gone for good, select "Didn't get a code?" or "Can't get to your devices?", then "Can't use [phone number]" to start account recovery, which Apple says can take days or longer.

Why does the sign-in map show the wrong place?

Apple says the location on a sign-in notification is approximate, based on the IP address or network the new device is using. If the sign-in is yours, you can still allow it. If it isn't, select Don't Allow.

Will my iPhone keep asking for a verification code?

No. Apple says once it's set up, your iPhone or Mac won't ask again unless you sign out of your Apple Account completely, erase the device, sign in on the Apple Account web page, or change your password for security reasons.

Sources