Which accounts should a landlord protect with two-factor sign-in?
Start with your email, then your bank, your property software, your cloud storage and your domain or website host. Use an authenticator app or a passkey instead of text messages when you can, and keep your recovery codes somewhere offline. A landlord's accounts hold tenant IDs, bank details and the power to move rent, so a stolen password alone should never be enough to get in.
Why landlords are a target
CISA, the US cyber agency, says multi-factor authentication adds a second proof of identity on top of a password, so a stolen password alone is not enough. Landlords are worth attacking: an inbox full of tenant IDs, vendor invoices and bank change requests is exactly what fraudsters want. They send fake alerts, fake invoices and fake tenant messages with a link, hoping you type your password into a copy of a real login page.
The order to turn it on
| Order | Account | Why |
|---|---|---|
| 1 | Your email | Every password reset goes to your inbox. Whoever controls it can reset the rest. |
| 2 | Your bank and payment apps | They hold rent and the money you pay vendors. |
| 3 | Property software and documents | They hold leases, IDs and tax forms. |
| 4 | Cloud storage, phone account and password manager | They hold copies of everything and your codes. |
| 5 | Domain, website and listing accounts | Hijacking them lets a scammer send mail as you or post fake ads. |
Which kind of second step to choose
| Method | Strength | Notes |
|---|---|---|
| Passkey or security key | Strongest | Resists fake login pages because it only works on the real site. |
| Authenticator app code | Strong | A six-digit code that changes every 30 seconds. Works without cell service. |
| Text message code | Better than nothing | A scammer who takes over your phone number can receive it. Use it only if nothing else is offered. |
| Email code | Weak if the email has no second step | Only as strong as the inbox. |
CISA says to prefer phishing-resistant methods where they are offered, which means passkeys and security keys.
Set it up without locking yourself out
- Pick an authenticator app and install it on your phone.
- Turn on two-factor in each account's security settings, scan the code, and enter the first six-digit code to confirm.
- Save the recovery codes the account gives you. Print them or write them down and keep them in a locked place, not in the same inbox.
- Add a second device or a second method if the account offers it, so a lost phone is not a crisis.
- Use a password manager and a different long password for each account.
- Tell anyone who shares an account, such as a partner or an assistant, and give each person their own login where the system allows it.
- If you lose your phone, use a recovery code, sign in on a new device, and move the app. Then sign out the lost device.
A code a stranger asks you to read out loud, in a text, an email or a call, is a scam. No real bank or software company needs it.
Review the list twice a year. Remove sign-ins for people who no longer work with you, such as a former helper or bookkeeper, change any shared password they knew, and check each account's list of signed-in devices for any you do not recognize.
Two-factor sign-in in DoorKeeping
DoorKeeping lets you add two-factor sign-in under Settings. It uses a code from an authenticator app on top of your email, Google or passkey sign-in, with ten one-time recovery codes in case you lose your phone. The approval page also asks for the code. Approvals for money or a legal step always wait for the owner's tap, whichever way you connect. DoorKeeping is $2 per unit per month with $0 in other fees.
Sources
- CISA, More than a password: multifactor authentication, read Oct 30, 2026
- FTC, Cybersecurity for Small Business, read Oct 30, 2026
- CISA, Implementing phishing-resistant MFA (fact sheet), read Oct 30, 2026
Questions
- Is a text message code good enough?
- It is better than a password alone, but an authenticator app or a passkey is stronger because a scammer cannot get it by taking over your phone number.
- What if I lose my phone?
- Use the recovery codes you saved when you set it up, sign in on a new device, and move your authenticator app. Keep recovery codes somewhere offline.
- Do my tenants need two-factor too?
- Not for this. It matters most for you and your helpers, since your accounts can move money and open tenant records.