One in a series of posts on Facebook Security and Privacy

You should consider enabling Two Factor Authentication (often shortened to 2FA) for logging in to Facebook. This means in addition to having a unique password for Facebook (that you don’t use for any other online services), you also have to enter a (usually) 6 digit code (or receive a SMS text message) to confirm that it really is you signing in.

The two factors in “two factor” are 1) your password and 2) the 6 digit code.

The clever thing is that the 6 digit code changes every 30 seconds, so it’s no good writing it down as it will be out of date very quickly.

If you have a smart phone or tablet

  1. Install an authenticator app on your device. I recommend (and use) the Microsoft Authenticator app (which is available for iOS, Android and Windows Phone), but there’s other options including Google Authenticator and Authy.
  2. Open Facebook in your web browser (preferably on a different device to your smartphone)
  3. Go to Settings, then Security and then Login Approvals Facebook Security Settings
  4. In the Code Generator section, click on third-party app.
  5. A QR Code (like a barcode) appears.
  6. On your smartphone, open the Microsoft Authenticator app
  7. Click on ‘+’ to add a new account
  8. Choose Other
  9. Hold your smartphone in front of your computer’s web browser so that the phone’s camera can scan the QR Code.
  10. It should automatically scan the code and add a new account entry for Facebook. eg. Microsoft Authenticator
  11. Note the 6 digit number now being displayed on your phone.
  12. Also notice there’s a countdown timer displayed next to this number. When this timer reaches zero, the number will expire and a new number will be displayed.
  13. Switch back to your web browser and enter this number in the confirmation field and press Confirm
  14. Click Enable to allow Login Approvals.
  15. Click on Get Codes
  16. Enter your password
  17. Print out these codes and keep them in a safe place. You can use these codes as a last resort if you lose access to the Authenticator app (eg. your phone drops in the toilet)
  18. It is also a good idea to provide your mobile phone number as a fall back in case you lose access to the Authenticator app (eg. you accidentally deleted it).

From now on, each time you log in to Facebook from a new device you will need to provide the current 6 digits from the Authenticator app as additional proof of identity. If you use some devices regularly, you can then choose not to require two factor authentication in the future.

If you use the Facebook App on your device, that can also function as an authenticator app. The downside to using this is that it only works for Facebook, whereas an app like Microsoft Authenticator can work with many online services.

These include Amazon, Dropbox, Facebook, GitHub, Google accounts, Microsoft Accounts, Mailchimp, Twitter and others. Always choose to enable 2FA for any online services you use. Many banks and financial institutions are also using similar systems.

If you have a mobile phone

  1. Open Facebook in your web browser (preferably on a different device to your smartphone)
  2. Go to Settings, then Security and then Login Approvals
  3. In the Text message (SMS) section, if there is no number listed click on Add phone number
  4. Follow through confirming the phone number

From now on, when you log in to Facebook you’ll receive a SMS text message with a code. You’ll then need to provide that code in addition to your password. If you use a device regularly, you can tell Facebook not to prompt for 2FA again.

Using 2FA with text messages is much better than not using 2FA at all, but it isn’t quite as secure as using an authenticator app. If you can’t use an app then do enable 2FA using SMS. Some services even support non-mobile numbers by reading out the code instead of as a text message.