{ "batch": "72-account-security", "articles": [ { "id": "learn_r72_account_security_72_onlyfans_2fa_methods", "category": "Safety", "title": "[Unverified - being checked] OnlyFans: Two-factor authentication methods supported", "summary": "[Unverified - being checked] OnlyFans supports two-factor (Two-Step) authentication via authenticator app (Google Authenticator or Microsoft Authenticator) or SMS code sent to the registered phone number; no hardware security key support is mentioned.", "body": "OnlyFans supports two-factor (Two-Step) authentication via authenticator app (Google Authenticator or Microsoft Authenticator) or SMS code sent to the registered phone number; no hardware security key support is mentioned.\n\nWhat OnlyFans actually says:\n\n“To use Two-Step Authentication you will need to download an authenticator app/software on your mobile or desktop. The most popular authenticator Apps are Google Authenticator or Microsoft Authenticator. Please download the app/software and follow the instructions to set up Two-Step Authentication. Alternatively you can complete Two-Step Authentication by using the phone number registered to your account and receive a verification code by SMS.”\n\nNote: FINDING: Hardware security keys are not mentioned. SMS is explicitly offered as an alternative to an authenticator app, meaning users can choose SMS-only 2FA — which is vulnerable to SIM-swap. No hardware key option is stated.", "source_type": "official", "source_link": "https://onlyfans.com/help/179/189/193", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "OnlyFans", "evidence_quote": "To use Two-Step Authentication you will need to download an authenticator app/software on your mobile or desktop. The most popular authenticator Apps are Google Authenticator or Microsoft Authenticator. Please download the app/software and follow the instructions to set up Two-Step Authentication. Alternatively you can complete Two-Step Authentication by using the phone number registered to your account and receive a verification code by SMS.", "volatility": "low", "from_batch": "72-account-security", "subject": "OnlyFans", "topic": "Two-factor authentication methods supported", "applies_to_country": "*", "applies_to_scope": "Global OnlyFans", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_onlyfans_2fa_recovery", "category": "Safety", "title": "[Unverified - being checked] OnlyFans: Account recovery when phone number is unavailable", "summary": "[Unverified - being checked] If a user cannot access their linked phone number, they can use backup codes generated when SMS Verification was enabled; if no backup codes were saved, they must contact support@onlyfans.com with their @username and the email address used when the account was created.", "body": "If a user cannot access their linked phone number, they can use backup codes generated when SMS Verification was enabled; if no backup codes were saved, they must contact support@onlyfans.com with their @username and the email address used when the account was created.\n\nWhat OnlyFans actually says:\n\n“If you cannot access your linked phone number, you can log in to your Account using one of the backup codes generated when you enabled SMS Verification. If you haven't saved the codes and can't access the phone number linked to your account, please contact support@onlyfans.com and include your @username and the email address used when you created your Account.”\n\nNote: No government ID requirement is stated for this recovery path. Recovery relies solely on backup codes or the original registration email. No recovery timeline is published. Stage-name users: the @username can be the stage name, but the registration email must match what was originally provided.", "source_type": "official", "source_link": "https://onlyfans.com/help/179/189/191", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "OnlyFans", "evidence_quote": "If you cannot access your linked phone number, you can log in to your Account using one of the backup codes generated when you enabled SMS Verification. If you haven't saved the codes and can't access the phone number linked to your account, please contact support@onlyfans.com and include your @username and the email address used when you created your Account.", "volatility": "low", "from_batch": "72-account-security", "subject": "OnlyFans", "topic": "Account recovery when phone number is unavailable", "applies_to_country": "*", "applies_to_scope": "Global OnlyFans", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_instagram_2fa_methods", "category": "Safety", "title": "[Unverified - being checked] Instagram (Meta Accounts Center): Two-factor authentication methods supported", "summary": "[Unverified - being checked] Instagram (via Meta Accounts Center) supports three 2FA methods: authentication app (recommended), text message (SMS), and WhatsApp; WhatsApp requires SMS to be enabled first.", "body": "Instagram (via Meta Accounts Center) supports three 2FA methods: authentication app (recommended), text message (SMS), and WhatsApp; WhatsApp requires SMS to be enabled first.\n\nWhat Instagram / Meta actually says:\n\n“When you set up two-factor authentication on Instagram, you'll be asked to choose one of three security methods: Authentication app (recommended): Download an authentication app, such as Duo Mobile or Google Authenticator to get login codes. Text message: We'll send a login code to your mobile number. WhatsApp: Turn on the text message security method first. Then, you can turn on the WhatsApp security method to get login codes from WhatsApp.”\n\nNote: FINDING: Hardware security keys are not listed as an available method. SMS is available and is the basis for WhatsApp 2FA as well. Instagram does not mention hardware key support in the 2FA page. Note: backup codes can be used if phone/email is lost. Trusted device management is available after 2FA is enabled.", "source_type": "official", "source_link": "https://help.instagram.com/566810106808145", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Instagram / Meta", "evidence_quote": "When you set up two-factor authentication on Instagram, you'll be asked to choose one of three security methods: Authentication app (recommended): Download an authentication app, such as Duo Mobile or Google Authenticator to get login codes. Text message: We'll send a login code to your mobile number. WhatsApp: Turn on the text message security method first. Then, you can turn on the WhatsApp security method to get login codes from WhatsApp.", "volatility": "low", "from_batch": "72-account-security", "subject": "Instagram (Meta Accounts Center)", "topic": "Two-factor authentication methods supported", "applies_to_country": "*", "applies_to_scope": "Global Instagram; settings managed via Meta Accounts Center", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_x_twitter_2fa_methods", "category": "Safety", "title": "[Unverified - being checked] X (formerly Twitter): Two-factor authentication methods supported; SMS restricted to Premium subscribers", "summary": "[Unverified - being checked] X supports three 2FA methods: text message (SMS), authentication app (TOTP), and security key (hardware); SMS 2FA is only available to X Premium subscribers — non-Premium subscribers cannot use SMS 2FA.", "body": "X supports three 2FA methods: text message (SMS), authentication app (TOTP), and security key (hardware); SMS 2FA is only available to X Premium subscribers — non-Premium subscribers cannot use SMS 2FA.\n\nWhat X Corp actually says:\n\n“Effective March 20, 2023, we will no longer support two-factor authentication using text messages for non-Premium subscribers. At that time, if you have text message 2FA still enabled, you will be prompted to disable it before you can continue to use your account. Please note the availability of text message 2FA for X Premium may vary by country and carrier. There are three methods to choose from: Text message, Authentication app, or Security key.”\n\nNote: FINDING: Hardware security key is supported on X (FIDO). SMS 2FA is paywalled — free-tier accounts must use an authenticator app or hardware key. Security key can be the sole authentication method on X without another backup method. Users concerned about SIM-swap should use authenticator app or hardware key; the paywall effectively pushes non-Premium users toward stronger options.", "source_type": "official", "source_link": "https://help.x.com/en/managing-your-account/two-factor-authentication", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "X Corp", "evidence_quote": "Effective March 20, 2023, we will no longer support two-factor authentication using text messages for non-Premium subscribers. At that time, if you have text message 2FA still enabled, you will be prompted to disable it before you can continue to use your account. Please note the availability of text message 2FA for X Premium may vary by country and carrier. There are three methods to choose from: Text message, Authentication app, or Security key.", "volatility": "medium", "from_batch": "72-account-security", "subject": "X (formerly Twitter)", "topic": "Two-factor authentication methods supported; SMS restricted to Premium subscribers", "applies_to_country": "*", "applies_to_scope": "Global X; Premium subscription requirement for SMS applies globally but availability varies by country and carrier", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_reddit_2fa_methods", "category": "Safety", "title": "[Unverified - being checked] Reddit: Two-factor authentication: authenticator app only; passkeys also supported", "summary": "[Unverified - being checked] Reddit's two-factor authentication uses a 6-digit code from an authenticator app on the user's phone or device; passkeys (biometric/device-PIN-based public-key credentials) are also supported as an additional login option.", "body": "Reddit's two-factor authentication uses a 6-digit code from an authenticator app on the user's phone or device; passkeys (biometric/device-PIN-based public-key credentials) are also supported as an additional login option.\n\nWhat Reddit Help actually says:\n\n“Two-factor authentication is a way to add an extra level of security when you log in to your Reddit account. First, you log in with your Reddit username and password. (That's one factor.) Then, instead of being logged in right away, you'll be asked for an additional 6-digit authentication code generated from an app on your phone or device. (That's the second factor.)”\n\nNote: FINDING: Reddit 2FA requires an authenticator app; SMS is NOT listed as a 2FA method — Reddit skips SMS entirely. Passkeys are additionally supported (support.reddithelp.com/hc/en-us/articles/49063461551252). Because Reddit does not support passkey-only accounts, the original login method (email/password) remains. Hardware security keys are not explicitly mentioned as a separate 2FA option in either article. The absence of SMS 2FA is a positive security finding — Reddit is not vulnerable to SIM-swap via 2FA fallback.", "source_type": "official", "source_link": "https://support.reddithelp.com/hc/en-us/articles/360043470031-What-is-two-factor-authentication-and-how-do-I-set-it-up", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Reddit Help", "evidence_quote": "Two-factor authentication is a way to add an extra level of security when you log in to your Reddit account. First, you log in with your Reddit username and password. (That's one factor.) Then, instead of being logged in right away, you'll be asked for an additional 6-digit authentication code generated from an app on your phone or device. (That's the second factor.)", "volatility": "low", "from_batch": "72-account-security", "subject": "Reddit", "topic": "Two-factor authentication: authenticator app only; passkeys also supported", "applies_to_country": "*", "applies_to_scope": "Global Reddit", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_discord_2fa_methods", "category": "Safety", "title": "[Unverified - being checked] Discord: Multi-factor authentication methods: passkeys/security keys (recommended), authenticator app, SMS (discouraged); support team cannot remove MFA", "summary": "[Unverified - being checked] Discord supports three MFA types: passkeys/security keys (recommended as most secure and phishing-resistant), authenticator app (TOTP), and SMS; SMS is explicitly discouraged due to SIM-swap vulnerability and can only be enabled after an authenticator app is set up; backup codes are provided; the Discord Support team cannot remove MFA from an account.", "body": "Discord supports three MFA types: passkeys/security keys (recommended as most secure and phishing-resistant), authenticator app (TOTP), and SMS; SMS is explicitly discouraged due to SIM-swap vulnerability and can only be enabled after an authenticator app is set up; backup codes are provided; the Discord Support team cannot remove MFA from an account.\n\nWhat Discord actually says:\n\n“Discord supports three types of MFA: Security Keys (Passkeys), Authenticator App, and SMS. We recommend setting up a Security Key, but you can choose any combination of these options to secure your Discord account, and you'll always have Backup Codes in case you lose access to your MFA device. To be transparent, SMS MFA is better than no MFA, but not by a lot. Hackers have advanced a lot in recent years - they can intercept text messages and take over phone numbers without anyone realizing by performing a \"SIM Swap\" directly with carriers. While we do support SMS MFA, we don't recommend it - and it can only be enabled once you've already set up an Authenticator App. Important: Don't forget to save your backup codes after enabling MFA. The Discord Support team is not able to remove MFA from an account.”\n\nNote: CRITICAL FINDING: If MFA backup codes are lost AND the authenticator device is lost, recovery may be impossible — Discord Support cannot remove MFA. SMS can be added as a backup ONLY if an authenticator app is already configured. Hardware security keys (FIDO passkeys) are the recommended method.", "source_type": "official", "source_link": "https://support.discord.com/hc/en-us/articles/219576828-Setting-up-Multi-Factor-Authentication", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Discord", "evidence_quote": "Discord supports three types of MFA: Security Keys (Passkeys), Authenticator App, and SMS. We recommend setting up a Security Key, but you can choose any combination of these options to secure your Discord account, and you'll always have Backup Codes in case you lose access to your MFA device. To be transparent, SMS MFA is better than no MFA, but not by a lot. Hackers have advanced a lot in recent years - they can intercept text messages and take over phone numbers without anyone realizing by performing a \"SIM Swap\" directly with carriers. While we do support SMS MFA, we don't recommend it - and it can only be enabled once you've already set up an Authenticator App. Important: Don't forget to save your backup codes after enabling MFA. The Discord Support team is not able to remove MFA from an account.", "volatility": "low", "from_batch": "72-account-security", "subject": "Discord", "topic": "Multi-factor authentication methods: passkeys/security keys (recommended), authenticator app, SMS (discouraged); support team cannot remove MFA", "applies_to_country": "*", "applies_to_scope": "Global Discord", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_discord_recovery_mfa_lockout", "category": "Safety", "title": "[Unverified - being checked] Discord: Account recovery when MFA device is lost; password reset via email", "summary": "[Unverified - being checked] Discord password reset is handled via a reset email sent to the account's registered email address; Discord Support cannot reset passwords for users, only guide them to the support form; if MFA is enabled and backup codes are lost and the MFA device is gone, there is no stated recovery path.", "body": "Discord password reset is handled via a reset email sent to the account's registered email address; Discord Support cannot reset passwords for users, only guide them to the support form; if MFA is enabled and backup codes are lost and the MFA device is gone, there is no stated recovery path.\n\nWhat Discord actually says:\n\n“You'll receive an email to the email address tied to your Discord account with instructions on how to reset your password. Follow the instructions in the email to reset your password. Contact Us: The Discord Support team cannot reset your password for you, however, if you run into any other issues with your password please reach out to the team through the support form: https://dis.gd/contact”\n\nNote: Recovery is entirely email-dependent. If the email address is also compromised or inaccessible, there is no fallback described in primary documentation. No government ID requirement stated for password reset. Stage-name users: Discord does not require a legal name, so there is no identity-mismatch issue with recovery.", "source_type": "official", "source_link": "https://support.discord.com/hc/en-us/articles/218410947-How-to-Reset-or-Change-Your-Forgotten-Password-on-Discord", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Discord", "evidence_quote": "You'll receive an email to the email address tied to your Discord account with instructions on how to reset your password. Follow the instructions in the email to reset your password. Contact Us: The Discord Support team cannot reset your password for you, however, if you run into any other issues with your password please reach out to the team through the support form: https://dis.gd/contact", "volatility": "low", "from_batch": "72-account-security", "subject": "Discord", "topic": "Account recovery when MFA device is lost; password reset via email", "applies_to_country": "*", "applies_to_scope": "Global Discord", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_telegram_2fa_methods", "category": "Safety", "title": "[Unverified - being checked] Telegram: Two-step verification: cloud password plus SMS login code; recovery via email; 7-day reset without email", "summary": "[Unverified - being checked] Telegram's 2-Step Verification requires both an SMS code (sent to the registered phone number at login) and a user-set password; a recovery email address can be set up; if the 2SV password is forgotten and no recovery email is set, account reset (deletion of all messages/history) takes 7 days and can be cancelled from any logged-in device.", "body": "Telegram's 2-Step Verification requires both an SMS code (sent to the registered phone number at login) and a user-set password; a recovery email address can be set up; if the 2SV password is forgotten and no recovery email is set, account reset (deletion of all messages/history) takes 7 days and can be cancelled from any logged-in device.\n\nWhat Telegram actually says:\n\n“You can do this in Settings > Privacy and Security > 2-Step Verification. Once enabled, you will need both an SMS code and a password to log in. You can also set up a recovery email address that will help regain access, should you forget your password. If you do so, please remember that it's important that the recovery email account is also protected with a strong password and 2-Step Verification when possible.”\n\nNote: FINDING: Telegram's 2FA is fundamentally SMS-dependent — login always requires the SMS code to the registered phone number; the 2SV password is an ADDITIONAL layer, not a replacement. Hardware keys are not supported. If the phone number is SIM-swapped, the attacker can receive the login SMS code. The 2SV password then becomes the only barrier. Recovery email is critical; without it, account reset takes 7 days (Telegram blog 2021: 'There is a new password reset option that works even if you don't have a recovery email — as long as you're still logged into your account. The process will take 7 days'). The account reset destroys all cloud messages. No government ID is involved in Telegram recovery.", "source_type": "official", "source_link": "https://telegram.org/faq", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "Telegram", "evidence_quote": "You can do this in Settings > Privacy and Security > 2-Step Verification. Once enabled, you will need both an SMS code and a password to log in. You can also set up a recovery email address that will help regain access, should you forget your password. If you do so, please remember that it's important that the recovery email account is also protected with a strong password and 2-Step Verification when possible.", "volatility": "low", "from_batch": "72-account-security", "subject": "Telegram", "topic": "Two-step verification: cloud password plus SMS login code; recovery via email; 7-day reset without email", "applies_to_country": "*", "applies_to_scope": "Global Telegram", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_tiktok_2fa_methods", "category": "Safety", "title": "[Unverified - being checked] TikTok: Two-step verification methods: phone, email, authenticator app, password; passkeys also supported", "summary": "[Unverified - being checked] TikTok's 2-step verification supports four methods: phone (SMS), email, authenticator app (Google Authenticator or Microsoft Authenticator), and password; passkeys are additionally supported; TikTok recommends selecting at least two methods.", "body": "TikTok's 2-step verification supports four methods: phone (SMS), email, authenticator app (Google Authenticator or Microsoft Authenticator), and password; passkeys are additionally supported; TikTok recommends selecting at least two methods.\n\nWhat TikTok actually says:\n\n“Tap 2-step verification and choose at least two verification methods: Phone (recommended), Email (recommended), Authenticator (recommended). You'll need a third-party authenticator app, such as Google Authenticator or Microsoft Authenticator, installed on your device to use this option. Password.”\n\nNote: FINDING: Hardware security keys are not listed. SMS (phone) is explicitly offered and recommended alongside authenticator apps. Passkeys are supported via Settings → Account → Passkey. TikTok also supports trusted device management (Security checkup). No hardware FIDO key option is described. Friends verification is available as an account recovery method — see next record.", "source_type": "official", "source_link": "https://www.tiktok.com/support/faq_detail?id=7543604780950624824&category=web_account", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "TikTok", "evidence_quote": "Tap 2-step verification and choose at least two verification methods: Phone (recommended), Email (recommended), Authenticator (recommended). You'll need a third-party authenticator app, such as Google Authenticator or Microsoft Authenticator, installed on your device to use this option. Password.", "volatility": "medium", "from_batch": "72-account-security", "subject": "TikTok", "topic": "Two-step verification methods: phone, email, authenticator app, password; passkeys also supported", "applies_to_country": "*", "applies_to_scope": "Global TikTok", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_tiktok_recovery_friends_verification", "category": "Safety", "title": "[Unverified - being checked] TikTok: Account recovery via Friends Verification", "summary": "[Unverified - being checked] TikTok offers a Friends Verification recovery method that allows users to recover account access by requesting verification from trusted friends on TikTok, as an alternative when standard login methods are unavailable.", "body": "TikTok offers a Friends Verification recovery method that allows users to recover account access by requesting verification from trusted friends on TikTok, as an alternative when standard login methods are unavailable.\n\nWhat TikTok actually says:\n\n“How to recover your TikTok account with friends verification”\n\nNote: The section header 'How to recover your TikTok account with friends verification' appears in the table of contents on the fetched page but the body content for that section was not returned in the fetch (page was cut). The existence of friends verification as a recovery mechanism is confirmed by the section heading on TikTok's own help page. Details of the process (how many friends, what they must do) were not obtained from a primary source in this fetch.", "source_type": "official", "source_link": "https://www.tiktok.com/support/faq_detail?id=7543604780950624824&category=web_account", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "TikTok", "evidence_quote": "How to recover your TikTok account with friends verification", "volatility": "medium", "from_batch": "72-account-security", "subject": "TikTok", "topic": "Account recovery via Friends Verification", "applies_to_country": "*", "applies_to_scope": "Global TikTok", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_twitch_2fa_methods", "category": "Safety", "title": "[Unverified - being checked] Twitch: Two-factor authentication: SMS required first; TOTP optional; Authy account auto-created; phone number recovery via Authy", "summary": "[Unverified - being checked] Twitch requires SMS verification first to enable 2FA; an Authy account is automatically created and linked to the phone number regardless of which authenticator app is used; TOTP via any authenticator app is optional after SMS is set up; if the phone number is lost, the user must contact Authy to change it.", "body": "Twitch requires SMS verification first to enable 2FA; an Authy account is automatically created and linked to the phone number regardless of which authenticator app is used; TOTP via any authenticator app is optional after SMS is set up; if the phone number is lost, the user must contact Authy to change it.\n\nWhat Twitch actually says:\n\n“Note: SMS verification is always required first, even if you plan to use an authenticator app. If you're enabling Two-Factor Authentication on the Twitch mobile app, you will need to use SMS. When you enable 2FA on Twitch, an Authy account is automatically created and linked to your phone number. This happens regardless of which authentication app you use (Authy, Google Authenticator, Microsoft Authenticator, etc.). If you lose access to your phone number, you'll need to contact Authy to change it.”\n\nNote: CRITICAL FINDING: Twitch mandates SMS as the initial 2FA step. An Authy account is silently created for every Twitch user who enables 2FA — this is a hidden dependency. If a SIM swap occurs, an attacker can receive the Twitch SMS code. The user cannot bypass the SMS requirement. Affiliates and Partners are REQUIRED to have 2FA enabled to get started. Hardware security keys are not mentioned. Recovery of the Authy account after phone number loss requires contacting Authy, not Twitch. This is a significant SIM-swap vulnerability for creators.", "source_type": "official", "source_link": "https://help.twitch.tv/s/article/two-factor-authentication", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Twitch", "evidence_quote": "Note: SMS verification is always required first, even if you plan to use an authenticator app. If you're enabling Two-Factor Authentication on the Twitch mobile app, you will need to use SMS. When you enable 2FA on Twitch, an Authy account is automatically created and linked to your phone number. This happens regardless of which authentication app you use (Authy, Google Authenticator, Microsoft Authenticator, etc.). If you lose access to your phone number, you'll need to contact Authy to change it.", "volatility": "medium", "from_batch": "72-account-security", "subject": "Twitch", "topic": "Two-factor authentication: SMS required first; TOTP optional; Authy account auto-created; phone number recovery via Authy", "applies_to_country": "*", "applies_to_scope": "Global Twitch; SMS-first requirement is a critical finding", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_google_2fa_methods", "category": "Safety", "title": "[Unverified - being checked] Google (YouTube): 2-Step Verification methods: passkeys, hardware security keys, authenticator app, SMS, backup codes, QR code; SMS explicitly flagged as vulnerable", "summary": "[Unverified - being checked] Google's 2-Step Verification supports passkeys, hardware security keys, Google Authenticator or other TOTP apps, SMS/voice verification codes, backup codes, and QR code verification; Google recommends passkeys and hardware security keys for phishing resistance and explicitly warns that SMS/voice codes 'can be vulnerable to phone number-based hacks.'", "body": "Google's 2-Step Verification supports passkeys, hardware security keys, Google Authenticator or other TOTP apps, SMS/voice verification codes, backup codes, and QR code verification; Google recommends passkeys and hardware security keys for phishing resistance and explicitly warns that SMS/voice codes 'can be vulnerable to phone number-based hacks.'\n\nWhat Google actually says:\n\n“A hardware security key is a small device that you can buy to help verify it's you when you sign in. When we need to make sure it's you, you can simply connect the key to your phone, tablet, or computer. Tip: Although any form of 2-Step Verification adds account security, verification codes sent by texts or calls can be vulnerable to phone number-based hacks. Use Google Authenticator or other verification code apps. Prompts can also help protect against SIM swap and other phone number-based hacks.”\n\nNote: FINDING: Google explicitly names SIM swap as a risk for SMS-based 2SV. Google Prompts (push notifications to signed-in devices) are recommended over SMS and are described as protecting against SIM swap. Hardware security keys and passkeys are the strongest options. YouTube accounts are Google accounts — securing the Google account secures YouTube. New 2SV phone numbers take up to 7 days to be trusted by Google (security delay).", "source_type": "official", "source_link": "https://support.google.com/accounts/answer/185839", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Google", "evidence_quote": "A hardware security key is a small device that you can buy to help verify it's you when you sign in. When we need to make sure it's you, you can simply connect the key to your phone, tablet, or computer. Tip: Although any form of 2-Step Verification adds account security, verification codes sent by texts or calls can be vulnerable to phone number-based hacks. Use Google Authenticator or other verification code apps. Prompts can also help protect against SIM swap and other phone number-based hacks.", "volatility": "low", "from_batch": "72-account-security", "subject": "Google (YouTube)", "topic": "2-Step Verification methods: passkeys, hardware security keys, authenticator app, SMS, backup codes, QR code; SMS explicitly flagged as vulnerable", "applies_to_country": "*", "applies_to_scope": "Global Google accounts; YouTube uses Google account security", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_google_recovery_lockout_avoidance", "category": "Safety", "title": "[Unverified - being checked] Google (YouTube): Account recovery setup: recovery contact, recovery phone, recovery email; 7-day delay on new authentication factors", "summary": "[Unverified - being checked] Google recommends setting up a recovery contact (another Google account), a recovery phone number, and a recovery email address to avoid account lockout; changes to authentication or recovery factors take up to 7 days to take effect, during which a compromised account can be quickly re-secured.", "body": "Google recommends setting up a recovery contact (another Google account), a recovery phone number, and a recovery email address to avoid account lockout; changes to authentication or recovery factors take up to 7 days to take effect, during which a compromised account can be quickly re-secured.\n\nWhat Google actually says:\n\n“If you recently made changes to your account's authentication or recovery factors, it may take up to 7 days for those changes to take effect. If someone tries to use your account without your permission, this allows you to quickly secure your account. For your security, you can't call Google for help to sign into your account. We don't work with any service that claims to provide account or password support. Do not give out your passwords or verification codes.”\n\nNote: No government ID is required for Google account recovery — recovery is based on previously set recovery contacts, phone, email, and account knowledge questions. Google explicitly states it cannot be called for account recovery. Advanced Protection Program (Google APP) is available for high-risk users and requires hardware security keys.", "source_type": "official", "source_link": "https://support.google.com/accounts/answer/7684753", "last_verified": "2026-09-03", "reliability": "VERIFIED RULE", "source_tier": "A", "source_publisher": "Google", "evidence_quote": "If you recently made changes to your account's authentication or recovery factors, it may take up to 7 days for those changes to take effect. If someone tries to use your account without your permission, this allows you to quickly secure your account. For your security, you can't call Google for help to sign into your account. We don't work with any service that claims to provide account or password support. Do not give out your passwords or verification codes.", "volatility": "low", "from_batch": "72-account-security", "subject": "Google (YouTube)", "topic": "Account recovery setup: recovery contact, recovery phone, recovery email; 7-day delay on new authentication factors", "applies_to_country": "*", "applies_to_scope": "Global Google accounts", "tags": { "lane": "any", "stage": "any", "region": [ "any" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_cisa_sim_swap_guidance", "category": "Safety", "title": "[Unverified - being checked] CISA / FBI: Government guidance: migrate away from SMS-based MFA; use FIDO/hardware keys; set telco PIN to counter SIM-swap", "summary": "[Unverified - being checked] CISA and FBI jointly recommend migrating away from SMS-based MFA entirely because SMS messages are unencrypted and can be intercepted; they recommend FIDO phishing-resistant authentication (hardware security keys such as YubiKey or Google Titan, or FIDO passkeys) and setting a telecom carrier PIN to prevent SIM-swap attacks.", "body": "CISA and FBI jointly recommend migrating away from SMS-based MFA entirely because SMS messages are unencrypted and can be intercepted; they recommend FIDO phishing-resistant authentication (hardware security keys such as YubiKey or Google Titan, or FIDO passkeys) and setting a telecom carrier PIN to prevent SIM-swap attacks.\n\nWhat CISA / FBI actually says:\n\n“Migrate away from Short Message Service (SMS)-based MFA. Do not use SMS as a second factor for authentication. SMS messages are not encrypted—a threat actor with access to a telecommunication provider's network who intercepts these messages can read them. SMS MFA is not phishing-resistant and is therefore not strong authentication for accounts of highly targeted individuals. Enable Fast Identity Online (FIDO) phishing-resistant authentication. FIDO authentication uses the strongest form of MFA and is effective against MFA bypass techniques. Where feasible, hardware-based FIDO security keys, such as Yubico or Google Titan, are the most effective; however, FIDO passkeys are an acceptable alternative. Set a Telco PIN. Most telecommunications providers offer the ability to set an additional PIN or passcode for your mobile phone account. This PIN is required for logging into your account or completing sensitive operations such as porting your phone number, a critical step in countering subscriber identity module (SIM)-swapping techniques.”\n\nNote: Key action items from CISA for creators relying on social/creator platforms: (1) Replace SMS 2FA with FIDO/passkeys wherever the platform supports it. (2) Enable a carrier PIN at the mobile carrier account level to block SIM-swap porting. (3) Note that even enrolling in authenticator-based MFA does NOT automatically remove SMS as a fallback — the user must manually disable SMS after enrolling in stronger methods. (4) For Gmail/Google: enroll in Advanced Protection Program. CISA publication date: December 18, 2024.", "source_type": "official", "source_link": "https://www.cisa.gov/sites/default/files/2024-12/joint-guidance-mobile-communications-best-practices_v2.pdf", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "CISA / FBI", "evidence_quote": "Migrate away from Short Message Service (SMS)-based MFA. Do not use SMS as a second factor for authentication. SMS messages are not encrypted—a threat actor with access to a telecommunication provider's network who intercepts these messages can read them. SMS MFA is not phishing-resistant and is therefore not strong authentication for accounts of highly targeted individuals. Enable Fast Identity Online (FIDO) phishing-resistant authentication. FIDO authentication uses the strongest form of MFA and is effective against MFA bypass techniques. Where feasible, hardware-based FIDO security keys, such as Yubico or Google Titan, are the most effective; however, FIDO passkeys are an acceptable alternative. Set a Telco PIN. Most telecommunications providers offer the ability to set an additional PIN or passcode for your mobile phone account. This PIN is required for logging into your account or completing sensitive operations such as porting your phone number, a critical step in countering subscriber identity module (SIM)-swapping techniques.", "volatility": "low", "from_batch": "72-account-security", "subject": "CISA / FBI", "topic": "Government guidance: migrate away from SMS-based MFA; use FIDO/hardware keys; set telco PIN to counter SIM-swap", "applies_to_country": "US", "applies_to_scope": "US CISA/FBI guidance; applicable globally as best practice", "tags": { "lane": "any", "stage": "any", "region": [ "us" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } }, { "id": "learn_r72_account_security_72_cisa_mfa_phishing_resistant", "category": "Safety", "title": "[Unverified - being checked] CISA: MFA guidance: FIDO/WebAuthn is the only widely available phishing-resistant authentication; SMS and TOTP are not phishing-resistant", "summary": "[Unverified - being checked] CISA states that the only widely available phishing-resistant authentication is FIDO/WebAuthn; SMS and authenticator code TOTP are better than no MFA but are not phishing-resistant, and CISA urges all organisations to plan a move to phishing-resistant MFA.", "body": "CISA states that the only widely available phishing-resistant authentication is FIDO/WebAuthn; SMS and authenticator code TOTP are better than no MFA but are not phishing-resistant, and CISA urges all organisations to plan a move to phishing-resistant MFA.\n\nWhat CISA actually says:\n\n“Not all MFA methods gives you the same level of protection. Some MFA types are better than others—phishing-resistant MFA is the standard all industry leaders should strive for, but any MFA is better than no MFA. You should still strive to implement stronger MFA to avoid being hacked. The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication. CISA urges all organizations to start planning a move to”\n\nNote: CISA's 'More than a Password' page is marked as archived but the guidance remains current. The key hierarchy: FIDO/WebAuthn (hardware keys, passkeys) > Authenticator TOTP codes > SMS/voice codes > No MFA. TOTP codes are vulnerable to real-time phishing (man-in-the-middle). Only FIDO keys are phishing-resistant.", "source_type": "official", "source_link": "https://www.cisa.gov/MFA", "last_verified": "2026-09-03", "reliability": "STRONG PRACTICE", "source_tier": "A", "source_publisher": "CISA", "evidence_quote": "Not all MFA methods gives you the same level of protection. Some MFA types are better than others—phishing-resistant MFA is the standard all industry leaders should strive for, but any MFA is better than no MFA. You should still strive to implement stronger MFA to avoid being hacked. The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication. CISA urges all organizations to start planning a move to", "volatility": "low", "from_batch": "72-account-security", "subject": "CISA", "topic": "MFA guidance: FIDO/WebAuthn is the only widely available phishing-resistant authentication; SMS and TOTP are not phishing-resistant", "applies_to_country": "US", "applies_to_scope": "CISA guidance; widely applicable", "tags": { "lane": "any", "stage": "any", "region": [ "us" ], "platform": "any", "topic": [ "unclassified" ], "explicitness": "any" }, "verification": { "status": "unverified", "label": "Unverified - being checked", "reasons": [ "legal_fetch_over_cap" ], "checked_utc": "20261021-123916Z" } } ] }