---
title: "Second factors and recovery · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery
updated: 2026-10-20
licence: "All rights reserved"
---

# Second factors and recovery

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Make second factors easy to set up and recovery hard to abuse. Recovery codes, two factors each and a slow, loud last resort keep owners in and attackers out.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery`.

## Required

- [Confirm a second factor before turning it on](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/mfa-enrolment): Turn on a new second factor only after the person proves it works once, and let them give it a name.
- [Give recovery codes with the first second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-codes): When someone turns on a second factor, give them 10 single-use recovery codes of at least 64 random bits each, and store only their hashes.
- [Plan for losing every factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-without-factors): Write down one recovery path for people who lost every factor and every recovery code. Make it slower and louder than sign-in.
- [Tell people about every change to their sign-in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/security-notifications): Notify every verified address within 5 minutes of a security change. That means an added or removed factor, a used recovery code, a new email or password, or a new device.

## Recommended

- [Ask everyone to keep two ways in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/two-authenticators): Prompt each person with one second factor to add another, such as a second passkey or a security key.
- [Let organisations require a second factor](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/org-mfa-policy): Let organisation owners require a second factor for every member, and hold members without one at a setup page.

## Avoid

- [Never use security questions](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/no-security-questions): Never use security questions, or facts such as a birth date or the last digits of a card, to sign in or recover an account.

- Previous: [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods)
- Next: [Sessions and security activity](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity)
- [All chapters](https://agentwranglers.se/playbook/accounts)