Two-factor login
Add a second step to signing in, so a stolen password is not enough on its own. Save the recovery codes.
You hold other people's tax documents. Two-factor is the difference between someone having your password and someone having your clients' paperwork.
Turning it on
- Go to your profile and find the security section.
- Start the setup. A QR code appears.
- Scan it with an authenticator app: Google Authenticator, 1Password, Authy, whichever you already use.
- Enter the six-digit code it shows you, to prove it worked.
- Save your recovery codes somewhere safe. See below, this is the important bit.
From then on, signing in asks for a code from your app as well as your password.
The recovery codes
The recovery codes are your only way back in if you lose your phone. Not a support ticket, not an email to us. Save them somewhere that is not your phone: a password manager, or paper in a drawer. People skip this step and then lose their phone, and that is a genuinely bad day.
Each code works once. If you use some, generate a fresh set.
If you lose your phone
Sign in with a recovery code, then set up two-factor again on your new phone.