You can now add a second step to signing in, from Security in your dashboard. It means somebody who has your password still cannot get into your account. It is off unless you turn it on, and turning it off again never needs anyone’s permission but yours.
You pick the methods, and the order. Choose any of an authenticator app, your fingerprint or face, a physical security key, or a code by text — and turn off the ones you do not want offered. Whichever you put first is the one you are asked for first; the rest are there as a fallback. If you only want an authenticator app, that is the only thing you will be shown.
Recovery codes are always included and cannot be switched off. Losing your phone should not mean losing your account, so you will always be offered codes to save or print.
Turning a method off changes what you are offered when setting one up — it never stops you using something you have already set up, so you cannot accidentally lock yourself out from this screen. To stop using one for good, remove it from the same page.
A passkey remains the quickest and safest option and still works on its own. If you already use one, you are covered.
What changed
Two-step verification gives customers control over an additional sign-in check. The Security page lets you choose the offered methods and their order instead of applying the same preference to every account.
Available methods include an authenticator app, fingerprint or face, a physical security key and text codes. The first method in your order is offered first, with the others available as fallbacks.
Before and after
Before this update: This dashboard configuration for choosing second-step methods and their order was not available.
With this update: You can enable the second step, select the methods you want offered and keep recovery codes as a fallback. Recovery codes are always included.
What it means for you
Set up a method you can use reliably and save the recovery codes somewhere you can reach if your phone is lost. Check your fallback choices before relying on a single device.
Turning off a method’s setup option does not remove something already enrolled; removal is a separate action on the page. Passkeys continue to provide their own sign-in protection. Keep security decisions in your own account rather than asking support to bypass them.