1. Is MFA enabled on your email account?

Yes No / Not sure

Email is the reset path for everything else. MFA here is non-negotiable.

2. Is MFA enabled on your bank and financial accounts?

Yes No / Not sure

Even if it's only SMS — turn it on today.

3. Is MFA enabled on your password manager master account?

Yes No / Not sure

If the password manager falls, everything falls.

4. Are you using an authenticator app (not SMS) where possible?

Yes No / Not sure

SMS codes can be SIM-swapped. Google Authenticator, Authy, 1Password Authenticator are all free.

5. Are recovery codes printed / saved to a safe you can actually find?

Yes No / Not sure

If your phone dies and you didn't save recovery codes, you're locked out. Print them.

6. Is MFA enabled on your work accounts (Google Workspace, Microsoft 365, etc.)?

Yes No / Not sure

Your admin may be able to enforce this for you.

7. Is MFA enabled on your social media accounts?

Yes No / Not sure

Account takeover on social leads to impersonation scams of your friends and family.

8. Is MFA enabled on shopping / delivery accounts storing card info?

Yes No / Not sure

Amazon/eBay/shopping accounts hold saved cards — lock them down.

9. Do you use a hardware key (YubiKey) for the most critical accounts?

Yes No / Not sure

Hardware keys are phish-proof. $25 gets you one and covers 99% of threats.

10. Do you know how to add a NEW MFA method if you lose your phone tomorrow?

Yes No / Not sure

Test your recovery path before you need it. Add a second authenticator device or hardware key.

11. Does your family / shared accounts also have MFA?

Yes No / Not sure

Attackers pivot through family members. Help them turn it on too.

12. Do you review MFA-active devices monthly (and remove old ones)?

Yes No / Not sure

Old phones listed as trusted devices are a lateral-movement risk. Remove them.

MFA Readiness Checker