2FA just means you need two things to get access. Like with your ATM card —the card itself and your PIN. Increasingly, other online accounts text you a one-time code to enter before completing a transaction.

Experts say now’s the time to truly embrace this technology. A Microsoft report concluded that 2FA works far better than the username/password approach, blocking 99.9% of automated attacks. Both Microsoft and Google wholeheartedly urge adoption of 2FA where possible.

But for what accounts should you proactively enable 2FA?
You probably have login credentials at dozens of online services that support 2FA, so the best strategy is to make a prioritized list and work your way through it:

1. Password/identity managers. Using a password manager is perhaps the best way to ensure that you have a strong, unique password for every service, but that also creates a single point of attack. Adding 2FA shores up this potential weakness.

2. Microsoft and Google accounts. If you use services from either company, adding 2FA support is essential.

3. Email accounts. If bad actors take over your email account, they can wreak havoc—email messages are a standard means of sending password reset links.

4. Social media accounts. As with email, the biggest risk associated with a hacked Twitter or Facebook account is that it will be used against your friends and associates. Even if you rarely post, you should protect these accounts.

5. Banks and financial institutions. Most banks and credit card companies have made significant investments in back-end fraud detection programs, so their 2FA options may seem limited. Nonetheless, it’s worth exploring these settings and tightening them as much as possible.

6. Shopping and online commerce. Any site at which you’ve saved a credit card number should be secured.