The Privacy Setting More Users Are Quietly Turning On

The Step That Makes the Biggest Difference

Consumer protection organizations, cybersecurity firms, and government
agencies including the FBI and FTC broadly agree on which single account
security step provides the most meaningful protection against
unauthorized access: two-factor authentication, also called two-step
verification or 2FA. Enabling it on financial accounts, email accounts,
and other accounts holding sensitive information means that even if a
password is compromised, an attacker cannot access the account without a
second verification step that only the account holder controls.

Pew Research data from 2025 documented a gradual increase in the share
of American adults taking deliberate steps to protect their online
privacy and security - including reviewing app permissions, using
separate passwords across accounts, and enabling additional verification
steps. The increase was most pronounced among adults under 50, while
adults in the 50-and-older demographic - who are also more frequently
targeted by impersonation and account takeover scams - showed lower
adoption rates.

Why It Matters More Than Passwords Alone

The FBI’s November 2025 public service announcement about bank
impersonation fraud documented that most account takeover attacks
exploit compromised passwords - credentials that have been leaked in
prior data breaches, purchased from criminal markets, or obtained
through phishing. Having a strong, unique password helps, but passwords
alone have a fundamental vulnerability: they can be stolen without the
account holder knowing, and used from anywhere in the world.

Two-factor authentication disrupts that scenario by requiring a second
piece of verification - typically a code sent to a phone, generated by
an authenticator app, or confirmed through a separate device - before
access is granted. The FBI’s IC3 documentation of bank impersonation
fraud found that even when attackers obtained passwords, accounts with
two-factor authentication were substantially harder to take over,
because the attacker also needed access to the physical device receiving
the verification code.

It is worth noting, as the FBI’s PSA also acknowledged, that
text-message based two-factor authentication - the most common form -
can itself be vulnerable to certain social engineering attacks in which
scammers trick account holders into reading them the code. Authenticator
apps, which generate codes locally on the device rather than
transmitting them via text, provide stronger protection. But even
text-based 2FA is significantly more protective than a password alone
for the vast majority of attack scenarios most people are likely to
face.

Reviewing App Permissions as a Second Habit

Beyond authentication settings, consumer privacy guidance from the FTC
and Consumer Reports consistently identifies periodic review of app
permissions as a high-value, low-effort protective habit. Many apps on
phones and tablets hold permissions - access to location, contacts,
microphone, camera, or storage - that were granted at installation and
have not been revisited since. Some of those permissions may no longer
serve any function the user actively wants.

The practical habit is simple: reviewing the permissions granted to apps
on a device once or twice a year, and revoking any that are not clearly
necessary. This does not eliminate privacy risk, but it reduces the
passive data exposure that accumulates through unused or forgotten app
access over time. AARP’s fraud prevention guidance specifically
identifies this step as one that older adults, who may have accumulated
apps over several years of device use, are particularly likely to
benefit from.

Why It Gets Skipped

Security researchers have long noted that the most effective protective
steps are often the ones that feel the most administrative - and
therefore the most deferrable. Unlike changing a password after a
breach, enabling two-factor authentication requires finding the setting,
choosing an authentication method, and completing a setup process. That
friction, even when the total time involved is under five minutes, is
enough to keep adoption rates lower than the step’s protective value
would suggest it should be.

The FTC’s consumer fraud data makes the stakes concrete. Americans
reported 15.9 billion dollars in total fraud losses in 2025. Imposter
scams - the category most directly connected to account access fraud -
accounted for 3.5 billion dollars of that figure. The accounts most
vulnerable to takeover are those with no second layer of verification
protecting them.

A Practical Starting Point

For adults who have not yet enabled two-factor authentication on their
primary accounts, the most impactful places to start are email, banking,
and any account linked to a payment method. Most major platforms have
the setting under Security or Privacy in account settings. The option to
use an authenticator app, if available, is more protective than
text-based codes - but enabling the text-based version is meaningfully
better than no second factor at all.

Account security is not a one-time task. Like other practical digital
habits, it benefits from brief periodic attention - checking that
authentication is enabled, reviewing which devices are authorized to
access accounts, and revisiting app permissions annually. None of these
steps require technical skill. They require only a few minutes and the
habit of making them routine.

References: New trends in reports of imposter scams | Account Takeover Fraud via Impersonation of Financial Institutions