Two-factor authentication on an Apple Account, done properly
· 5 min read
Two-factor is on by default for Apple Accounts now, and most people never look at it again. That is fine until the day you lose access to every trusted device at once, at which point the recovery path you never set up becomes the most important thing you own.
How it works
Signing in from a new device requires your password plus a six-digit code, delivered to a device already signed in to your account, or by text to a trusted phone number.
Your existing Macs, iPhones and iPads are trusted devices. They display the code automatically when a sign-in is attempted.
The weakness is obvious once stated: if the only trusted devices are the ones you just lost, and the trusted number is the SIM in the phone that went with them, you have no route in.
Set the recovery path now
This is the part worth ten minutes today.
Add a second trusted phone number. System Settings, your name, Sign-In & Security, then Trusted Phone Numbers. A partner’s number, a family member’s, a work line. Any number you can reach if your own phone is gone.
This single step resolves most lockouts and almost nobody does it.
Add a recovery contact. Someone you trust who can generate a code to help you back in. They cannot access your account or your data; they can only assist recovery. Available in the same settings panel.
Or generate a recovery key. A 28-character code that replaces Apple’s assisted recovery entirely. More secure, and unforgiving: lose both the key and access to your devices, and the account is unrecoverable. Apple cannot help, by design.
For most people, a second trusted number plus a recovery contact is the right arrangement. A recovery key suits people who understand the trade and will store it properly.
Where to store a recovery key
Not on your devices. That is the whole point.
Printed and in a drawer, in a safe, or in a password manager you can reach from a machine that is not an Apple device. Two copies in different places is not excessive for something with no fallback.
Account recovery, and why to avoid needing it
If you lose everything and have no recovery contact or key, Apple’s account recovery process exists. It takes days, sometimes longer, and is deliberately slow to prevent it being abused as an attack route.
During that wait you have no access to photos, purchases, iCloud files, or the passwords in your keychain. For most people that is a substantial part of their digital life.
The wait is the reason to set up the recovery path in advance rather than trusting the process.
What two-factor does not protect
Being persuaded to hand over a code. The most common attack now. Someone calls claiming to be Apple, or a fake page asks for the code you just received. Codes are for you to enter, never to read out or forward. Apple does not ring you and ask for one. The fake support call covers the pattern.
A weak password, since the code is the second factor, not the only one.
Someone with access to an unlocked trusted device, which is why device passcodes matter.
App-specific passwords
Some older software cannot handle two-factor. Rather than weakening the account, generate an app-specific password: sign in at account.apple.com, and create one under Sign-In & Security.
It works for that one application and can be revoked without changing anything else. Review the list occasionally and revoke ones you no longer use.
While you are in there
Two things worth checking in the same visit.
The device list. System Settings, your name, at the bottom. Remove anything you no longer own. A Mac you sold that is still listed can still receive verification codes.
Your password. If it is reused anywhere else, change it. A password manager makes this painless and is worth the setup. Passwords in Safari, and moving to a dedicated manager covers the options.
Questions
Can I turn two-factor off? For accounts created recently, no. Older accounts had a brief window after enabling it. It is not something to want off.
What if I change my phone number? Update the trusted numbers before the old number stops working. This is a common cause of lockouts after moving country.
Do I get a code every time I sign in? Only on a new device or browser, or after signing out. Trusted devices do not re-prompt.
Is a recovery key better than a recovery contact? More secure and less forgiving. A contact is better for most people; a key is better if you can store it reliably and understand there is no fallback.