Two-step verification: how to protect your business accounts

Early on a Monday, the person who runs your ads messages you: "I can't get into the ad account". A little later you find out someone changed the email on your Facebook page and is spending on your card. It happens more than you think, and it almost always starts with a single leaked password. Two-step verification is the barrier that prevents it.

What is two-step verification?

It's a layer of security that asks you for something more than the password to get into an account. Google defines it in its help on 2-Step Verification as an extra level of protection for when your password is stolen. With it on, you sign in with your password and a second step, or with a passkey.

In practice, if someone gets your password from a device the account doesn't recognize, they're stuck at the door: they're missing the code, the key or the confirmation on your phone.

Which business accounts should I protect first?

Start with the ones that stop your sales if you lose them: your main email, Meta and WhatsApp. Email is the key to everything else, because that's where password reset links arrive. Next come the Meta business portfolio, where your pages and ad accounts live, and the WhatsApp account you use to serve customers.

Account	Why it's critical	Where to turn it on
Google (email)	Recovers the other accounts	Google Account, Security and sign-in
Facebook and Meta	Pages, ads and payments	Accounts Center, Password and security
Business portfolio	Access for your whole team	Meta Business Suite Security Center
WhatsApp	Conversations with customers	Account settings in the app

How do I turn it on in Google?

Open your Google Account, go to Security and sign-in and choose Turn on 2-Step Verification. Then follow the on-screen steps. Google notes that with work or school accounts you may not be able to do it yourself, and in that case you should ask your administrator.

For the second step, Google offers several options: passkeys, physical security keys, prompts on your phone, authenticator apps, text or voice codes and backup codes. It also warns that if you add a new phone number, it can take up to 7 days to trust it.

Heads up: Google points to SMS codes as the option most vulnerable to attacks using your phone number. If you can, use phone prompts, a passkey or a physical security key.

How do I turn it on in Facebook and in the Meta business portfolio?

In Facebook, go to Settings, then Accounts Center, Password and security and Two-factor authentication. Facebook's help says you can choose from three methods: a security key, codes from an authentication app or SMS codes. You can also get 10 recovery codes for when your phone isn't at hand.

For the business, the key step is in the Meta Business Suite Security Center. Meta explains that two-factor authentication is mandatory for business portfolios more than 90 days old, and recommends making it a requirement for everyone with access. From there you can also add another person with full control, so you're not left without an admin if someone leaves. If you haven't done it yet, also check business verification in Meta.

And in WhatsApp?

WhatsApp also has two-step verification, and it's optional: you decide to turn it on. According to its Help Center, when you turn it on you can use your phone number, a password or your email address as additional authentication, and set up a passkey with your fingerprint, face recognition or your phone's screen lock.

WhatsApp is replacing the 6-digit PIN with a password. If you already had a PIN, you can switch to a password from the two-step verification settings. If you use the same number in the app and in the API, check how WhatsApp coexistence works.

Common mistake: turning on two-step verification only on the owner's account. If your team gets into the business portfolio with unprotected accounts, the weak spot is still there.

What else can I do so my accounts don't get stolen?

Keep your recovery codes outside your phone and never share a verification code. Google is clear: it won't call you to ask for a code. Anyone who asks for one by phone or chat is almost always a scammer.

Also make sure your email doesn't end up in spam or isn't easy to spoof, with what we explain in SPF, DKIM and DMARC. And if you handle customer data, keep in mind what Colombia's data protection law, Ley 1581, requires.

In short

Back to the Monday of the lost account: with two-step verification on for your email, Meta and WhatsApp, a leaked password is no longer enough to get in. It takes you an afternoon to set it up for the whole team. If you'd rather we leave your accounts, domain and email well protected, see our hosting and domains service.