Turning on two-factor sign-in

Two-factor sign-in asks for a six-digit code from an app on your phone as well as your password. Somebody who learns your password still cannot get in without the phone.

Set it up

1. 1
   Open Security settings

   Go to Settings › Security. The Two-Factor Authentication card offers an Authenticator App, which works with apps such as Google Authenticator, Authy or Microsoft Authenticator. Choose Set Up 2FA. If your access level needs it, the same setup appears by itself the first time you open the company.

2. 2
   Scan the QR code

   Scan the code on screen with your authenticator app. If you cannot scan it, type the secret shown underneath into the app instead.

3. 3
   Enter the code from the app

   Type the six-digit code your app shows into Verification Code and choose Enable 2FA.

   Two-Factor Authentication

   Verification Code

   123456
4. 4
   Save your recovery codes

   Next you are shown your recovery codes. Each one works once and they cannot be shown again, so copy or download them and keep them somewhere safe. Tick I have saved my recovery codes in a safe place to finish.

Signing in afterwards

When you sign in you are asked for a code from the app. On a private device you trust, you can choose to remember that browser for 14 days, so it stops asking there.

Filing with HMRC is the exception. Submitting a VAT return asks for a fresh code from your app every time, even on a remembered browser, and a recovery code will not do for it.

If you lose your phone

Sign in with one of your recovery codes in place of the app code. Settings › Security shows how many you have left, and Regenerate Recovery Codes gives you a fresh set of ten.