Explain MFA without the jargon
A child does not need to memorise authentication terminology. You can explain MFA as using two different kinds of proof before an account lets you in. One proof might be a password, while another might be a code from an app, a passkey, a security key or a fingerprint.
The extra step matters because stealing one proof should not automatically give someone everything they need to sign in.
Unexpected codes are a warning sign
If a child receives a verification code they did not request, they should not send it to anyone or enter it into a page reached through an unexpected message. The code may mean someone else is trying to sign in.
The safer response is to open the real service directly, review recent activity if available and tell a trusted adult. If there are signs of an unauthorised login, change the password and sign out unknown sessions.
Never approve a login just to make the notification stop
Some services send an approval notification to a phone or device. Repeated prompts can tempt a person to press approve simply to clear them. Children should learn that an unexpected approval request deserves the opposite response: deny it and ask for help.
An attacker who already has a password may be waiting for one accidental approval to complete the login.
Choose the strongest practical option
Where available, passkeys and security keys can provide strong protection and reduce reliance on passwords. Authenticator apps are another useful option. SMS codes can still add protection where stronger options are not available.
The best family setup is the one that is secure and manageable enough to be used consistently, with recovery methods stored safely and understood by the responsible adult.
Start with the most important accounts
Email accounts deserve particular attention because they are often used to reset passwords for other services. Gaming, school, cloud storage and social accounts can also benefit from MFA when it is available.
If enabling MFA everywhere feels overwhelming, start with email and the accounts that would cause the most harm or disruption if someone else took control of them.
MFA gives families a second chance to stop an account takeover. Protect verification codes, deny unexpected login prompts and turn on an extra authentication factor wherever practical.
Continue with the Cyber Safety Hub, practise the ideas in Ranger Academy, or use the free printable resources at home or in the classroom.