Locking your account down

Two-factor authentication means that knowing your password is no longer enough to get into your account. Somebody also needs the phone in your pocket. It is optional here — nobody is forced into it — and it is the single most useful ten minutes you can spend on your own security.

Turning it on

1. Sign in, open My Account, and choose Two-Factor Authentication. The page is /my-account/two-factor/ if you would rather go straight there.
2. Install an authenticator app on your phone if you have not got one. Google Authenticator, Authy and 1Password all work, and so does anything else that produces six-digit codes.
3. Scan the square code on screen with that app.
4. Type the six-digit code the app gives you back into the form to prove it worked.
5. Save the backup codes you are offered. Put them somewhere that is not your phone — a password manager, or written down and kept with your passport.

From then on, signing in asks for your password and then a code. The code changes every thirty seconds and your phone generates it without needing a signal.

If you lose your phone

Use one of the backup codes you saved. Each works once, and one of them will get you in so you can set the app up again on a new handset.

If the phone and the backup codes have both gone, the account itself is not lost. Two-factor can be removed from an account by an administrator: that puts the account back to a password-only sign-in, and you can then set an app up again from scratch. Nobody at this end can read your codes or your password — switching the requirement off is the only thing that can be done from the other side. The contact page is where to ask.

Next: what the membership tiers unlock.