Turning on two-factor authentication

Two-factor authentication is the single best thing you can do to protect your account. Even if someone learns your password, they cannot get in without your phone.

It adds a 6-digit code from an authenticator app to your sign-in. Here is how to turn it on:

1. Go to your account settings and choose Enable under two-factor. 2. Add the key to your authenticator app. 3. Enter the 6-digit code it shows.

You then get 10 recovery codes. They are shown once, so save them somewhere safe, away from your phone. Each one works a single time if you ever lose access to your authenticator.

What changes: from then on, signing in asks for a code, and so does every withdrawal and every tip. Withdrawals and tips need a current code from your authenticator app; recovery codes are not accepted for them, and after 8 wrong codes they are locked for up to 15 minutes.