Why a phone number alone is not enough.
Every major messaging app treats your phone number as the primary key to your account, which is convenient until someone else manages to take control of that number, through a SIM swap, a carrier error or a lost phone that still holds an active SIM. Without a second layer, whoever controls the number can reinstall the app on their own device and read every conversation, including a booking thread, from that point forward.
Two-step verification adds a PIN that the app asks for independently of the SIM, so possession of the number alone is no longer enough to take over the account. It takes a few minutes to set up and, once done, needs almost no further attention. Think of it as a second lock fitted to a door that a phone number alone used to be able to open on its own.
Setting it up on WhatsApp.
Settings, Account, Two-Step Verification, then Enable, prompts for a six digit PIN you choose yourself, followed by an optional email address WhatsApp uses only to help you reset the PIN if you forget it. The email is genuinely optional, but worth adding, since a forgotten PIN without a recovery email means waiting out WhatsApp's own security delay before the account can be reset at all, a delay measured in days rather than minutes.
Once enabled, WhatsApp will periodically ask for the PIN again during normal use, a mild inconvenience in exchange for the account no longer being transferable on a phone number alone.
Setting it up on Telegram.
Settings, Privacy and Security, Two-Step Verification, asks for a password rather than a numeric PIN, which can be longer and more complex if you prefer. Telegram also offers an optional recovery email, and, distinctively, a hint you can set for yourself, shown if you forget the password, without revealing it to anyone else who might see the prompt.
Telegram's version behaves slightly differently from WhatsApp's: it is asked for when logging into a new device, rather than periodically during ordinary use on a device already signed in. Both approaches achieve the same goal, they simply interrupt your day at different points.
Setting it up on Signal.
Signal's equivalent lives under Settings, Account, and is built around a PIN you set when the app is first installed, with Registration Lock as a further toggle that specifically stops the account being reregistered on a new device without that PIN. Signal is somewhat stricter here than the other two apps, since losing the PIN with no recovery method set can genuinely mean losing access to the account rather than simply being asked to wait it out.
Our guide to Signal covers the app more broadly if this is the first you are hearing of it; the PIN described here is a small part of a design built around privacy from the ground up.
Choosing a PIN worth keeping.
A PIN reused from a bank card or a phone lock defeats some of the purpose, since it means one leaked number opens more than one account elsewhere, while a PIN too obscure to remember tends to get written down somewhere far less secure than the app itself. A short, memorable phrase converted to numbers, or a pattern meaningful only to you, usually strikes the right balance.
Whichever method you choose, add the optional recovery email on WhatsApp and Telegram before you need it rather than after, since setting it up in a hurry once a PIN is already forgotten is the harder version of the same five minute task, and one that offers far fewer options once the account is already locked out.
What happens if you forget it.
Each app handles a forgotten PIN differently, and all three favour security over convenience when it happens. WhatsApp locks new registration attempts for a growing delay, up to several days, unless a recovery email speeds the process along. Telegram relies on its personal hint or the recovery email you set. Signal, without a recovery method configured, offers the least flexibility of the three, which is worth knowing before you choose a PIN you might not remember in six months.
None of the three will simply email you the PIN itself if you forget it, since that would undermine the entire feature; every recovery path is designed to prove it is genuinely you asking, not to hand the PIN back on request.
Pairing this with the rest of your setup.
A PIN protects the account itself, while app lock and lock screen previews, covered elsewhere in this series, protect what happens once someone already holds an unlocked phone. Set both, and neither a stolen SIM nor a borrowed phone gets very far. None of it changes how an evening is arranged: browsing the roster and confirming an extended booking around Amsterdam Oost works the same whether or not two-step verification is switched on, and a companion filed under 22 to 25 or curvy confirms it through the same booking thread either way.