Apple's two-step verification system works by requesting an additional four-digit verification code every time a user logs in with their Apple ID and password. This prevents anyone from accessing or using an Apple account, even if they know the user's Apple ID and password.
Apple's two-step verification system can be set up by registering one or more trusted devices. To activate the two-step verification, users should navigate to Manage My Apple ID on the official Apple website and sign in. They need to select the Security and Password option and follow the instructions under Two-Step Verification. Once the steps have been completed, a four-digit verification code is sent to the selected trusted device via SMS or Find My iPhone. This code is now used as a second layer of security when signing in with an Apple ID.
The two-step verficiation system is applied every time a user signs into iCloud, iMessage, makes a purchase from iTunes or uses their Apple ID in any way. Along with the four-digit verification code, users also recieve a 14-character recovery key that can be used to regain access to an Apple account in the case of a lost trusted device or if the four-digit verification code has been forgotten.