Use an authenticator app or security key when available; SMS is still better than no second factor.
Do now: Enable two-factor authentication on your email account first.
Never approve a prompt you did not initiate.A stolen password is less useful when an attacker still lacks the second factor. Good recovery planning prevents the protection from locking out its owner.
Choose the strongest practical method
Security keys and passkeys resist many phishing attacks. Authenticator apps generate time-limited codes without depending on phone network coverage. SMS codes are more exposed to SIM attacks but still improve on password-only access.
Use the strongest method the service supports and you can reliably recover.
A factor that you cannot maintain is not a complete security plan.
Set it up deliberately
Open security settings through the official app or a typed address. Confirm the account name before scanning a setup code. Add a second method if the service allows it.
Save one-time recovery codes offline, away from the device that receives normal codes. Do not store them in the same exposed screenshot folder.
Respond to an unexpected prompt
Deny any approval request you did not start. Then change the password, review sessions and check whether recovery details were altered.
Repeated prompts may be an attempt to exhaust your attention. The correct response is not eventually pressing yes so the phone becomes quiet.
No request you started means no approval you should grant.