Google's default 2SV rollout cut account takeovers by half

What Google reported

In a post titled Making you safer with 2SV, published 8 February 2022, Google's director of account security and safety said that, since the previous year's initiative, Google had auto-enabled two-step verification for more than 150 million people and required it for more than 2 million YouTube creators. The post attributes a 50 percent decrease in compromised accounts among those users to the change. Two-step verification, as described in Google's own help documentation, adds a second check beyond a password, such as a prompt on a trusted device, a passkey, a hardware key, an authenticator app code, or a one-time code sent by text or call.

Why turning a default on beats publishing advice

Security guidance that asks a user to opt into a protection depends on that user finding the setting, understanding why it matters, and acting before an attacker does. An automatic enrolment removes two of those three steps: the user does not need to find the setting or decide to act, only to complete whatever second-factor prompt appears the next time they sign in somewhere unfamiliar. Google's reported result, a halving of compromise among the affected population, is consistent with a general pattern in security research: defaults change population-level behaviour far more reliably than advice does, because advice only reaches the fraction of people who read it and act on it.

What the reported figure does not establish

The 150 million figure and the 50 percent reduction come from Google's own post about its own product change; they are a vendor's account of a vendor's intervention, not an independently audited study with a control group. The post does not describe how compromise was measured, over what exact period the comparison was drawn, or whether the population that was auto-enrolled differed systematically from the population that was not. It is a legitimate data point about default design, not a peer-reviewed causal estimate, and should be read with that distinction in mind.

• Does your organisation's identity provider enable a second factor by default, or only offer it as an option?
• If you rely on a vendor's own reported security statistic, what would you need to see to treat it as more than a marketing claim?
• Which of your accounts still depend on a password alone because nobody set a default for them?

A default is a design decision with security consequences of its own; Google's account of this one is a useful illustration of why the decision, not just the advice that accompanies it, is where account security is actually won or lost.