Your Google account and 2-Step Verification

Your work Google account is the key to everything else. Lock it with a second step, set recovery options, and learn to tell a real Google prompt from a fake one.

One account, everything behind it

Your work Google account opens Gmail, Drive, Calendar, Chat, Meet and, through “Sign in with Google”, many other tools your business uses. If someone gets into it, they can read your mail, download your files, and send messages as you to customers and coworkers. Protecting this one account is worth ten minutes.

Three things make it safe: a second step at sign-in, recovery options that are up to date, and the habit of signing in only on pages you reached yourself.

Work account or personal account?

Many people have both. Keep them separate:

Use the work account for Use a personal account for
Anything about customers, suppliers, staff or money Personal mail, shopping, family photos
Files the business must keep when you leave Things that are yours
Calendar invites and meetings with the team Personal appointments (you can show them as busy on your work calendar)

If the business owns the account, the owner or admin can reset it, recover files from it and close it when someone leaves. That is a feature, not a threat.

2-Step Verification

With 2-Step Verification (2SV) on, a stolen password is not enough; the thief also needs your phone or a passkey. Google offers several second steps. Pick the strongest one your phone supports:

Second step Strength Notes
Passkey Strongest Uses your phone or computer’s fingerprint, face or PIN. Cannot be used on a fake site.
Security key Strongest A small USB or NFC device. Good for shared front-desk computers.
Google prompt Strong A “Is this you?” notification on your phone. Only approve sign-ins you just started.
Authenticator app Strong Six-digit codes from an app. Works without signal.
Text message code Basic Better than nothing; can be intercepted. Use as a backup, not the main method.

Also save your backup codes somewhere safe (your password manager is a good place) for the day your phone is lost or dead.

Why a stolen password alone no longer opens the account.

Flow diagram: step 1 is the password, something you know that can be stolen; step 2 is something you have, ranked strongest (passkey or security key), strong (Google prompt or authenticator, approving only sign-ins you started) and basic (text code, backup only); with both, you are in; a thief with the stolen password but not your phone is stopped; a note says to also set recovery phone, recovery email and backup codes
The second step is the one a thief cannot copy from a breach. Pick the strongest your phone supports and set recovery options for the day the phone is gone.

Recovery options

Set a recovery phone and a recovery email (a personal address is fine). Google uses them to confirm it is you if you are locked out, and to warn you about suspicious sign-ins. Check them once a year or whenever you change phone numbers.

Google’s own forty-second explainer of what 2-Step Verification adds.

Video: Safer with Google Presents: 2-Step Verification · Google · 1 minThe point to take away: a password alone is no longer enough to get in.Watch on YouTube (opens in a new tab)

Real prompt or fake?

Attackers imitate Google constantly: “Security alert: new sign-in from Windows”, “Your storage is full”, “Verify your account to avoid suspension.” Use three checks:

  1. The sender’s domain. Real Google account mail comes from accounts.google.com or another google.com address. Read the domain from the right: google-security-alerts.com and workspace-google.com are not Google.
  2. The link’s destination. Press and hold or hover. Real links go to google.com or myaccount.google.com. If in doubt, do not use the link: open your account’s Security page yourself.
  3. The prompt on your phone. A Google prompt appears only when someone has just entered your password. If you did not just sign in, tap No, it’s not me. That tells you your password has leaked; change it.

A sign-in approval you did not start is never a glitch. It is someone with your password trying to get in.

A genuine alert and a fake one, side by side.

Two mock emails: the genuine one is from no-reply@accounts.google.com with the subject Security alert: new sign-in and a Check activity button that goes to myaccount.google.com; the fake one is from security@google-security-alerts.com with the subject Verify now to avoid suspension and a Verify now button that goes to google-security-alerts.com; three checks follow: sender domain ends in google.com, link goes to google.com or open the Security page yourself, and a phone prompt you did not start gets No, it's not me and a password change
Same logo, same layout. The sender domain and the link destination are the only parts a scammer cannot copy.

Try it now

Open your Google Account’s Security page. If 2-Step Verification is off, turn it on and add a passkey or Google prompt. Then check your recovery phone and email are correct. Finally, look at “Your devices” and sign out anything you do not recognize.

Remember: second step on, recovery options current, and never approve a prompt you did not start. Real Google mail and links end in google.com, read from the right.

Checking your progress…