How to Set Up Two-Factor Authentication (2FA) on WhatsApp, Facebook, Instagram and Gmail

Someone knows your password. Perhaps you used the same password on a website that was hacked. Perhaps you typed it into a fake login page. Perhaps a friend guessed it, because it was your birthday. Whatever happened, that person can now open your account — unless you have two-factor authentication turned on.

Two-factor authentication, often called 2FA, adds a second check after your password. Even if someone knows your password, they cannot get in without a second piece of evidence that only you have — usually a code from your phone. It is the single most effective thing you can do to protect your accounts, and it takes less than ten minutes to set up on each app.

This guide walks you through setting up 2FA on the four accounts that matter most to a Nigerian business owner and phone user: WhatsApp, Facebook, Instagram, and Gmail. Do all four today. Your future self will thank you.

What Two-Factor Authentication Actually Is

When you log in with only a password, you are relying on one secret. If that secret leaks, your account is open. Two-factor authentication adds a second secret that lives on your phone, not in your head.

Here is how it works in practice. You enter your password as usual. Then the app asks for a six-digit code. That code is generated by an authenticator app on your phone, or sent to you by text message. The code changes every thirty seconds, and only your phone can produce the current one. An attacker sitting in another country with your password still cannot log in, because they do not have your phone.

There are three common methods for receiving the code. An authenticator app (such as Google Authenticator or Authy) generates codes on your phone and works even without network signal — this is the best method. A text message (SMS) sends the code to your phone number — this works well but is weaker, because a criminal who performs a SIM swap on your number can intercept it. One more thing to know before you start: every service will give you backup codes when you turn on 2FA. These are one-time codes you can use if you lose your phone. Save them somewhere safe — written on paper and kept at home, or in a password manager. If you lose your phone and you have no backup codes, getting back into your accounts becomes very difficult.

WhatsApp: Turn On Two-Step Verification

WhatsApp calls its version of 2FA "two-step verification", and it works a little differently from the others. Instead of a code that changes every thirty seconds, you set a six-digit PIN. WhatsApp asks for that PIN when someone tries to register your number on a new phone. That stops the most common WhatsApp attack in Nigeria: a criminal who gets your SIM or your verification code and registers your number on their phone, then asks your contacts for money.

Here is how to turn it on:

1. Open WhatsApp and go to Settings.
2. Tap Account, then tap Two-step verification.
3. Tap Turn on and choose a six-digit PIN. Pick a number you will remember, but not your date of birth, your phone number, or 123456.
4. Confirm the PIN by entering it again.
5. Add an email address. WhatsApp uses this to send you a reset link if you forget your PIN. Use an email address you can actually access — this step matters, so do not skip it.

That is it. From now on, anyone who tries to register your number on another phone will be asked for the PIN, and without it they cannot take over your account. WhatsApp will also ask you for the PIN occasionally when you open the app, just to make sure you still remember it.

Facebook: Two-Factor Authentication Through Accounts Centre

Facebook and Instagram are both owned by Meta, and Meta manages their security through one shared hub called Accounts Centre. If your Facebook and Instagram accounts are linked there, you can protect both from the same place. If they are not linked, repeat the steps in each app.

Here is how to turn on 2FA on Facebook:

1. Open Facebook and tap your profile picture in the top right, then go to Settings & privacy, then Settings.
2. Tap Accounts Centre, then tap Password and security.
3. Tap Two-factor authentication and select your Facebook account.
4. Choose your method. Authentication app is recommended: Meta will show you a QR code or a setup key. Open your authenticator app, add a new account, scan the code, and type the six-digit code it shows back into Facebook to confirm. You can also choose text message (SMS) if you prefer, though the authenticator app is safer.
5. Save your backup codes. Facebook will show you a set of one-time backup codes. Save them somewhere safe, away from your phone.

Menu labels can vary slightly between the Facebook app, the Facebook website, and different app versions, so if a label on your screen is a little different, look for the closest match. The path is always the same: Settings, Accounts Centre, Password and security, Two-factor authentication.

Instagram: The Same Path, in the Instagram App

Instagram uses the same Accounts Centre system as Facebook, so the steps are nearly identical:

1. Open Instagram, go to your profile, and tap the menu (the three lines in the top right).
2. Tap Accounts Centre, then tap Password and security.
3. Tap Two-factor authentication and select your Instagram account.
4. Choose your method. Instagram recommends the authentication app. If you already set up an authenticator app for Facebook, you can add Instagram to the same app — each account gets its own entry and its own code.
5. Save your backup codes when Instagram offers them.

One detail worth knowing: Instagram also offers WhatsApp as a 2FA method, but only after you have turned on text message codes first. The authenticator app remains the better choice, because it works without network signal and cannot be intercepted through your phone number.

If your Facebook and Instagram accounts are linked in Accounts Centre, turning on 2FA in one place may cover both. Check both accounts afterwards to be sure each one shows 2FA as on. Do not assume.

Gmail: Turn On 2-Step Verification

Your Gmail account is the most important of the four, because it is the key to everything else. Most services let you reset your password by sending a link to your email. If someone gets into your Gmail, they can reset your bank password, your Facebook password, and your shopping accounts. Protect it first, and protect it best.

Google calls 2FA "2-Step Verification". Here is how to turn it on:

1. Go to your Google Account. On your phone, open Settings, tap Google, then tap Manage your Google Account. On a computer, go to myaccount.google.com and sign in.
2. Tap or click Security.
3. Under "How you sign in to Google", tap 2-Step Verification, then tap Get started. You will be asked to sign in again — this is normal.
4. Follow the steps to add a verification method. Google will usually suggest a prompt on your phone first ("Google prompt"), which is convenient. Then add an authenticator app as a second option, because it works when you have no network signal.
5. Once 2-Step Verification is on, Google will give you backup codes. Save them somewhere safe — print them, or store them in a password manager. These are your way back in if you lose your phone.

After you turn it on, Google may ask for a code when you sign in on a new device. That is the point. A stranger with your password will be stopped at exactly that step.

Also check the recovery options on the same Security page while you are there: a recovery phone number and a recovery email address that you can actually access. If an attacker changes these, they can lock you out of your own account. Review them now, and review them again every few months.

What to Do If You Lose Your Phone

This is the question that stops many people from turning on 2FA: "What if I lose my phone and cannot get the codes?" It is a fair worry, and it has a real answer.

First, use your backup codes. Every service above gives you backup codes when you set up 2FA. One backup code lets you sign in once, and then you can turn off 2FA, set it up again on your new phone, and generate fresh codes. This is why saving the backup codes matters more than the setup itself.

Second, keep your recovery email and recovery phone number up to date on every account. If you lose your phone, the recovery options are how the service confirms you are really you.

Frequently Asked Questions

Is two-factor authentication really necessary if my password is strong?

Yes. A strong password protects you from guessing, but it does not protect you from leaks, phishing, or a data breach at a company you trusted. 2FA protects you when the password itself is compromised, which is the most common way accounts are stolen. A strong password and 2FA together are far stronger than either one alone.

Do All Four Today

This is a thirty-minute job, and it protects everything you have built online: your business chats, your customers, your photos, your money, and your reputation. Start with Gmail, because it guards all the rest. Then WhatsApp, because it is where your business lives. Then Facebook and Instagram.

If you suspect any of your accounts may already be compromised — strange messages sent from your account, logins you do not recognise, friends telling you they got odd messages from you — read our guide on 7 signs your phone may be hacked (and what to do about it) and act on it before you set up 2FA.

And if you would like help securing your business online, or building a website that your customers can trust, explore our services or contact us. We will be glad to help.