Two-Step Verification on WhatsApp, Gmail and Instagram

Two-step verification adds a second lock to your account, so a stolen password or OTP isn’t enough on its own. You can set it up on WhatsApp, Gmail and Instagram in about 10 minutes, and it’s free on all three.

There’s one mistake that can lock you out of WhatsApp for a full week, though, and one kind of attack this won’t stop at all. Both are in section 5, and you’ll want to read them before you set a password.

⚡ Key takeaways

WhatsApp: Settings > Account > Two-step verification. Add an email too, or a forgotten PIN can mean a 7-day wait.
Gmail: turn on 2-Step Verification in your Google Account, then save your backup codes.
Instagram: Accounts Center > Password and security > Two-factor authentication. Use an authenticator app if you can.
SMS codes are better than nothing, but Google calls them the most vulnerable option.
It won’t fix a hijacked WhatsApp Web session, so check your linked devices as well.

Table of Contents

What Two-Step Verification Actually Protects You From

Most of us think the OTP is the security. It isn’t, once a caller talks you into reading it out. With two-step verification on, the attacker also needs a second thing that only you know or hold, like a password or a prompt on your own phone.

Scammers in India aren’t short of ways to get an OTP. This January, the Indian Cyber Crime Coordination Centre (I4C) warned about USSD call forwarding. A fake courier caller gets you to dial a code starting with *21, and your calls and OTPs then go to their phone.

And it’s festive season. Fake greeting and gift links are making the rounds, as we covered in the Diwali greeting scam guide. If a relative’s WhatsApp gets taken over, you’re the next target. So it’s worth doing this for your parents’ phones too.

two-step verification and OTP scams: gloved hand holding a phone showing a call screen — A caller asking for a code should end the conversation. · Photo: Tima Miroshnichenko / Pexels

How to Turn On Two-Step Verification on WhatsApp

This is the one to do first, because a stolen WhatsApp can message your entire family asking for money.

Open WhatsApp and go to Settings > Account > Two-step verification.
Tap Turn on and set your code. WhatsApp’s help page says the 6-digit PIN is being upgraded to a password, so you may see either.
Add an email address when asked, and verify it. You can also do this later under Settings > Account > Email address.
Write the code somewhere safe and offline. Not in a WhatsApp chat.

💡 Pro tip

Your verified email does a second job. WhatsApp says it can send a 6-digit login code to your email when you re-register, and no active SIM is needed for that step. Handy if your phone goes missing during Diwali travel.

Also readIs My Phone Hacked? 9 Checks for Android and iPhone Users

How to Set Up 2-Step Verification on Gmail

Your Gmail is the master key, since it resets passwords for almost everything else. Google’s steps are simple:

Open your Google Account and go to Security & sign-in.
Under “How you sign in to Google”, choose Turn on 2-Step Verification.
Follow the prompts, then add a second step from the options below.

Second step	How it works	My take
Google prompt	Tap Yes on your phone	The easy default, and Google recommends it
Passkey or security key	Fingerprint, face or a physical key	The strongest against phishing, per Google
Authenticator app	Codes that work without internet or signal	Good for patchy networks
SMS or voice code	A 6-digit code sent to your number	Better than nothing, but Google says it’s the most vulnerable

After that, download your backup codes. These are 8-digit codes for when you’ve lost your phone, and without them a lost phone turns into a long account recovery. Print them, or store them away from the phone itself.

Tick “Don’t ask again on this device” only on a phone or laptop nobody else uses. Passkeys are worth a look once this is done, and our passkeys guide explains them in plain words.

two-step verification: hand holding a phone with lines of text on screen — A second step means a stolen password alone isn’t enough. · Photo: Andrey Matveev / Pexels

How to Enable Two-Factor Authentication on Instagram

Instagram calls it two-factor authentication, but it’s the same idea. Malwarebytes’ guide gives these steps, and menu labels can differ slightly by app version.

Open your profile and tap the three-line menu.
Go to Accounts Center > Password and security > Two-factor authentication.
Pick your account and choose a method.
Follow the prompts and enter the code.

You’ll see three main methods: an authentication app (recommended), text message or WhatsApp. I’d pick the app. It’s free, and Google Authenticator works fine for this.

Then get your backup codes. PanicVault’s guide points to Additional methods > Backup codes on the same screen, and notes each code works once. Don’t leave them in your Instagram DMs, which is exactly where you can’t reach them if you’re locked out.

The 7-Day Lockout and What This Won’t Stop

⚠️ Watch out

If you forget your WhatsApp code and never added an email, you could wait 7 days before you can reset it. WhatsApp’s help page says it can’t speed that up. So add the email today and verify it.

Now the limit I mentioned. Two-step verification guards the login, and some attacks skip the login. In August, the Home Ministry said I4C had protected over 10,000 Indians from a campaign using files like “RBI.zip” or “Statement of Account.zip”. Opened on a Windows computer, these install a Trojan that takes over the active WhatsApp Web session.

That’s why these three habits belong next to your new code:

Check Linked Devices in WhatsApp regularly, and log out of anything you don’t recognise.
Never open a .zip from a chat, even when it’s from a boss or relative.
Never dial a code a caller gives you. If you already did, I4C’s advice is to dial ##002# to turn off call forwarding, and report it on 1930.

Also readPhone Safety for Parents: 9 Settings to Fix on Your Diwali Visit

A 10-Minute Checklist for Your Family’s Phones

Sit down with your parents’ phones after the Diwali puja and do this in one go. They’ll grumble, but it’s worth the fuss.

WhatsApp: Turn on two-step verification and add an email. Check Linked Devices.
Gmail: Turn on 2-Step Verification, set up a Google prompt, and print the backup codes.
Instagram and Facebook: Turn on two-factor authentication.
Storage: Keep all the codes in one paper envelope in the cupboard, rather than in the phone gallery.
The rule: Agree on one family line: no code gets read out over a call, ever, whoever’s asking.

Our phone safety guide for parents has more settings to change while you’re at it. And if you’ve lost a phone already, block it on Sanchar Saathi before anything else.

Which Second Step Should You Choose?

✅ Our verdict

Do WhatsApp and Gmail today, even if you do nothing else. Use Google prompts or an authenticator app where you can, and accept SMS only where it’s the sole option, or for a parent who won’t manage anything more. An imperfect second lock still beats none. Save backup codes on paper.

Who can skip the authenticator app? Honestly, a parent with one phone and no patience. A Google prompt and an email-backed WhatsApp code will protect them plenty, and a simple setup they’ll keep using is better than a strict one they turn off.

Frequently Asked Questions

What is two-step verification on WhatsApp?

It’s an optional second code you set yourself, needed when your number is registered on WhatsApp again. Even someone with your SMS OTP is stopped without it. WhatsApp is moving this from a 6-digit PIN to a password.

What happens if I forget my WhatsApp two-step code?

If you added an email, you can get a reset link. If you didn’t, or you can’t reach that email, you may have to wait 7 days. WhatsApp says it can’t shorten this.

Is SMS verification safe enough?

It’s better than a password alone, but Google says text codes are the most exposed to phone-number attacks. Use a Google prompt, passkey or authenticator app if you can.

What if I lose the phone with my authenticator app?

That’s what backup codes are for. Google gives you 8-digit codes for this, and Instagram has its own. Keep them somewhere that isn’t the phone.

Does two-step verification stop all WhatsApp hacks?

No. It protects new logins, but malware can hijack a WhatsApp Web session that’s already open. Check Linked Devices and don’t open unexpected files.

The Bottom Line

Two-step verification won’t make you hack-proof, but it does stop the most common trick: someone reading your OTP off your screen or over a call. Open WhatsApp now, set the code and add your email. Then do Gmail before the day ends.

Keep reading

Sources

Two-Step Verification on WhatsApp, Gmail, Instagram in 10 Minutes