Passwords leak; second factors catch the break-in — unless your second factor is an SMS text anyone who hijacks your SIM can read.
Canadian banks, CRA My Account, provincial portals and every major email host now push multi-factor authentication. Not all factors are equal. This guide ranks methods, covers recovery and explains how to live with institutions that still insist on phone texts.
Factor ranking for real life
| Method | Strength | Notes |
|---|---|---|
| Hardware security key | Excellent | Best for email and password managers |
| Authenticator app (TOTP) | Strong | Works offline; back up seeds |
| Push prompts | Strong | Watch for fatigue / misfires |
| SMS / voice | Better than nothing | SIM-swap risk remains |
Start with email and the password manager
Whoever controls your email resets everything else. Enable the strongest 2FA available on Gmail, Outlook or iCloud, ideally a security key plus authenticator app. Protect the password manager with 2FA next — it holds the rest of the kingdom.
Authenticator apps without painting yourself into a corner
Use an app that supports encrypted export or multi-device sync you control. Save one-time recovery codes printed in a sealed envelope at home. When replacing a phone, transfer TOTP seeds before wiping the old handset. Losing the only device with your codes is a self-inflicted lockout.
Canadian banking reality
Many banks still lean on SMS or proprietary app push. Enrol in their official app notifications, set phone-account PINs with your carrier to reduce SIM-swap odds and treat SMS as a temporary bridge. Never approve a push login you did not initiate — decline and call the bank.
Government and provincial accounts
CRA, Service Canada and provincial health/tax portals increasingly support authenticator apps or partnered sign-in. Take the stronger option when offered. Keep legal names matching across IDs to avoid recovery hell after a move between provinces.
SIM-swap defence habits
- Carrier account PIN / port-out protection where offered.
- Unique passwords on carrier accounts — not your dog's name.
- Alert family: no one « verifies » your number for a stranger on the phone.
- Move high-value accounts off SMS as soon as alternatives appear.
Rollout order for a busy week
- Email + password manager.
- Apple/Google account that resets phones.
- Banking and investing apps.
- Cloud storage and photo libraries.
- Social networks and shopping sites.
2FA is not a product you buy once — it is a short list of accounts you harden in priority order, with recovery codes you can actually find.