Set up Google Authenticator and keep your backup codes

Google Authenticator shows a six-digit code that changes every 30 seconds. Instagram, Google, and many other accounts can ask for that code after your password. It is safer than an SMS code, because a new SIM does not receive it.

Install it the safe way

1. Install Google Authenticator only from the Play Store or the App Store. The publisher is Google. Do not install an APK, and do not use a link from a message.

2. Open the security page of the account yourself. For a Google account, type myaccount.google.com, then open Security, then 2-Step Verification, then Authenticator. For Instagram, use Accounts Centre inside the app.

3. Scan the QR code with the authenticator app. If the site also shows backup codes, write them on paper and keep them at home. Do not store that photo in a chat.

4. Enter the current six-digit code once, on that same site, to confirm the setup.

How the code gets misused

• A caller, or a chat, asks you to read the six digits “to confirm you are the owner.” They are signing in as you while the code is still valid.

• A page that looks like the real login asks for the code after you followed a link. You opened their page, not your account.

• Someone asks you to photograph the QR code and send it. That QR is the key. Anyone who has it can generate your codes.

When you change phones

Use the transfer option inside Google Authenticator while you still have the old phone. Do not turn off two-step verification first. If the old phone is already gone, use a backup code on the account’s own site, then set the app up again and write a fresh set of backup codes.

Google Authenticator can optionally sync codes to a Google account. That is convenient, and it also means anyone who can open that Google account can see the codes. Paper backup codes still matter.

If money has already left your account, call 1930 or report at cybercrime.gov.in. This page is awareness information. It does not file a complaint.