Two-Step Verification for Older Relatives
How to set up two-step verification for parents and older relatives in a way they can actually use: the simplest methods, clear rules about codes, and a recovery plan for lost phones.
Older relatives are frequent targets of account takeovers and scams, so two-step verification is especially valuable for them. But a method that is confusing will be switched off, or will lead to lockouts. The aim is protection they can actually use, with a plan for when things go wrong.
Choose the simplest strong method
| Method | Ease of use | Notes |
|---|---|---|
| Passkey (fingerprint or face) | Very easy once set up | Strong and phishing-resistant. See what is a passkey. |
| In-app approval | Easy | Teach: only tap "Yes" if you are signing in right now. |
| Text message code | Familiar | Most open to "read me the code" scams. See SMS weaknesses. |
| Authenticator app | Moderate | Strong, but can confuse some users when changing phones. |
A one-afternoon setup
- Start with their email. Turn on two-step verification and add a passkey if supported.
- Check recovery details: an up-to-date phone number and, if they agree, a trusted family member's email as a recovery contact.
- Save backup codes on paper with their important documents. See backup codes.
- Repeat for WhatsApp (two-step PIN) and any banking apps.
- Write down which accounts are protected and how, and keep it with the backup codes.
Our guide on helping older relatives secure their accounts covers a wider setup.
The rules to teach
Rule 1: never read out, forward or type a code because someone called or messaged you.
Rule 2: never approve a sign-in you did not start.
Rule 3: if you are unsure, call me before you do anything.
Practise with them once: show them what a genuine prompt looks like when they sign in, and talk through what a scam call asking for a code sounds like. See how to verify a caller.
Plan for lost or new phones
- Keep backup codes on paper at home.
- Make sure their passkeys sync through their phone's cloud account.
- When they get a new phone, help them move everything before resetting the old one. See changing phones safely.
Make checking easy. Show them CyberWatch AI Scan, where they can paste any suspicious message for a free second opinion.
For the full picture, read our guide on how to protect your accounts.
Frequently asked questions
Which two-step method is easiest for older users?
Often passkeys (fingerprint or face) or simple in-app approvals, if they can remember never to approve prompts they did not start. Text codes are familiar but more open to scams.
Should I add my own number as a recovery option?
Only with their agreement, and only on accounts where they want your help. A trusted recovery contact can make lockouts much easier to fix.
What is the single most important rule to teach?
Never share a code or approve a sign-in because someone asks, even if they say they are from the bank or family.
Sources
- Use Two-Factor Authentication To Protect Your Accounts, US Federal Trade Commission
- Turn on 2-Step Verification, Google Account Help
- Fraud Watch Network Helpline, AARP
