After you set up a password manager for your parents, the next highest-value security upgrade is dead simple and takes five minutes: turn on two-factor authentication for their email account. That is it. One setting, one phone number, five minutes of your time.
Why email specifically and not their bank, not their social media, not their medical portal? Because email is the master key. Every password reset for every other account flows through email. If an attacker compromises your parent’s email, they can reset the password to their bank, their Apple ID, their Social Security account, everything. Email 2FA stops that attack cold.
This guide covers exactly how to turn it on for the three email providers your parents are most likely using: Gmail, Outlook, and iCloud. Pick the one that applies, follow the steps, and you are done.
Why 2FA matters more for your parents than for you
You probably already have 2FA on your accounts. You use an authenticator app or a hardware key. Your parents do not, and they are the ones being targeted. Adults over 60 file more than 100,000 fraud complaints per year with the FBI, and email account takeover is the most common entry point. The attacker does not need to hack the bank. They just need to reset the bank password through the email account, and if that email account has no second factor, the reset goes through.
SMS-based 2FA is not perfect — SIM swapping exists, and phishing for SMS codes is a known attack. But for elderly parents, SMS 2FA is the right starting point because it requires zero new apps, zero new hardware, and zero new behavior. They already know how to receive a text message. They already know how to type a six-digit code. The perfect is the enemy of the good: SMS 2FA on their email today is worth more than a YubiKey on their email never.
If you want to upgrade to a hardware key later, the last section covers that too. But start with SMS. Get something in place now.
Gmail: turn on 2FA in 3 minutes
This assumes your parent has a Gmail or Google Workspace email address. If they use a Google account but get email through another provider, 2FA still applies to the Google account itself.
Step 1: On their phone or computer, go to myaccount.google.com/security. Sign in with their Google credentials. If you set up a password manager, it should autofill the password.
Step 2: Tap “2-Step Verification.” Google may walk you through a quick check first — confirm their phone number if asked. Google often prompts for 2FA setup automatically during sign-in; if that happened, it may already be partially enabled.
Step 3: Under “2-Step Verification,” tap “Get Started.” Google will send a code to their phone via SMS or a phone call. Have your parent read the code to you and type it in. This confirms the phone number is theirs.
Step 4: After the code is verified, Google will ask if you want to add a backup method. Say yes — add a second phone number if available (yours, a sibling’s, or a landline). This is the recovery option if their primary phone is lost.
Step 5: Google will show 10 one-time backup codes. Print these or write them down. Store them somewhere safe in your parent’s home — a drawer, a safe, or the same place you put the password manager master password. These codes are the last-resort recovery if both phone and backup phone are unavailable.
Done. Gmail 2FA is now on. Every time someone tries to sign in to your parent’s Google account from a new device, Google will require both the password and a code sent to their phone.
Outlook / Microsoft: turn on 2FA in 3 minutes
If your parent uses an Outlook.com, Hotmail, Live, or Microsoft 365 email address:
Step 1: Go to account.microsoft.com/security. Sign in.
Step 2: Click “Advanced security options” or “Two-step verification” (Microsoft rearranges this page regularly — look for anything that says “two-step” or “2FA”).
Step 3: Turn on two-step verification. Microsoft will ask for a phone number or email address. Use their mobile phone number for SMS codes — it is the simplest option for elderly users.
Step 4: Verify the phone number with the code Microsoft sends. Confirm.
Step 5: Microsoft will generate an “app password” — this is a special 16-character password for older devices that do not support 2FA prompts. Your parent does not need to memorize it. If they use an email app on their phone that cannot handle 2FA prompts (some older Android email apps), you may need to enter this app password once. Modern iPhone Mail and Outlook apps handle 2FA natively and do not need app passwords.
Done. Microsoft 2FA is now on.
iCloud / Apple: turn on 2FA in 2 minutes
If your parent uses an iCloud email address (@icloud.com or @me.com), 2FA is called “Two-Factor Authentication” in Apple’s settings, and it is usually enabled by default on newer devices. Check:
On iPhone/iPad: Settings → [Their Name] → Password & Security → look for “Two-Factor Authentication.” If it says “On,” you are done. If not, tap “Turn On Two-Factor Authentication” and follow the prompts.
On Mac: System Settings → [Their Name] → iCloud → Password & Security → Two-Factor Authentication.
Apple will ask for a trusted phone number. Enter your parent’s mobile number. Apple sends a verification code via SMS. Enter it. Apple will also generate recovery codes — write these down and store them alongside the password manager master password.
Apple’s 2FA is particularly well-integrated: once enabled, it automatically applies to iCloud email, iMessage, FaceTime, iTunes purchases, and Apple ID sign-in. There is no per-account setup needed.
What to tell your parents after setup
Do not say “I turned on two-factor authentication.” Say this:
“I made your email safer. Now, if anyone tries to log in to your email from a computer that is not yours, Google will send a code to your phone and they cannot get in without it. You do not need to do anything different. Just type the code if it ever asks — and if you did not try to sign in and it asks for a code, call me first.”
That is the entire explanation. Two sentences. No jargon. Your parent now knows: (1) something got safer, (2) they might occasionally see a code prompt, (3) if they see one and did not expect it, they should call you.
Upgrading from SMS to a hardware key (optional)
If your parent is tech-comfortable enough, or if you want the strongest possible protection, you can replace SMS with a hardware security key like a YubiKey. This is a small USB device that your parent taps or plugs in when signing in. No codes to type, no SMS to wait for, no SIM-swap risk.
The catch: your parent needs to physically have the key every time they sign in to their email on a new device. If they lose the key, recovery is harder than with SMS. For most elderly users, this is a step-up to consider after they are comfortable with basic 2FA, not a starting point.
Which YubiKey to get: The YubiKey 5 NFC (~$45-50) works with both USB-A (computers) and NFC (phones — just tap it against the back of the phone). It is the most versatile option.
How to add a YubiKey to Gmail: myaccount.google.com/security → 2-Step Verification → Add security key → follow the prompts. The YubiKey does not need batteries, does not need an app, and does not need a network connection. It is a piece of hardware that proves “the person holding this key is the account owner.”
For most families, SMS 2FA on email is sufficient. A YubiKey is a nice upgrade for parents who are comfortable with it.
FAQ
What if my parent loses their phone?
If they have SMS 2FA, they need their phone number transferred to a new phone (call the carrier — this is routine and takes 10 minutes). If they set up a backup phone number during 2FA setup, Google/Microsoft can send codes to the backup number. If neither option is available, use the backup codes that were generated during setup. If you lost the backup codes too, Google and Microsoft have account recovery processes that take 3-7 days — slow but workable. Write the backup codes down. Store them.
Can I turn on 2FA for my parent remotely?
Yes, if you have access to their email account (for example, if they shared their password with you or if you set up the account on their behalf). Sign in to the security settings page listed above, follow the steps, and verify using their phone number. The phone itself does not need to be in your hands — your parent just needs to read you the SMS code when it arrives.
Should I turn on 2FA for their bank too?
Yes, but do it after email. Bank 2FA is important, but most banks already require it or offer it by default. Email is the one most people skip, and email is the highest-value target because it controls password resets for everything else. Email first, bank second, social media third.
Does 2FA prevent all email hacks?
No. 2FA prevents account takeover from password-only attacks, which is the most common vector. It does not prevent phishing attacks where your parent voluntarily enters both a password and a code on a fake login page. The defense against that is the password manager (which will not autofill on a fake domain) and the scam prevention conversations. 2FA is one layer of a multi-layer defense, not a silver bullet.
What about passkeys? Are those better than 2FA?
Passkeys (FIDO2/WebAuthn without a physical key) are the future and are gradually being adopted by Google, Apple, and Microsoft. They replace passwords entirely with device-based authentication — your parent’s phone or computer becomes the key. In 2026, passkey support is still uneven across services, and the setup process is confusing for non-technical users. Stick with SMS 2FA now, and consider passkeys when the setup UX matures — probably in 2027-2028.
What to do next
With a password manager in place and email 2FA turned on, your parents now have the two highest-value security upgrades possible. The remaining items on the list — scam prevention conversations, a quarterly phone checkup, and AI privacy settings — are complementary layers that make the foundation stronger. But the foundation is these two things: unique passwords on every site, and a second factor on email. Everything else is gravy.