--- title: "Two-step verification" description: "Protect your BankSync login with an authenticator app, save a recovery key for a lost phone, and see your recent security activity." section: "Account & billing" canonical: "https://banksync.io/docs/account-billing/two-factor-authentication" specs: ["auth"] operationBindings: [{"capability":"auth","operation":"auth.mfa.enrol"},{"capability":"auth","operation":"auth.mfa.unenrol"},{"capability":"auth","operation":"auth.security.sync"},{"capability":"auth","operation":"auth.security.event.record"},{"capability":"auth","operation":"auth.security.status.get"},{"capability":"auth","operation":"auth.security.activity.list"},{"capability":"auth","operation":"auth.email.verification.send"},{"capability":"auth","operation":"auth.email.password-reset.send"},{"capability":"auth","operation":"auth.email.action.apply"}] --- Two-step verification (also called two-factor authentication, or 2FA) adds a six-digit code from an authenticator app to your password or Google sign-in. Once it is on, nobody can get into your BankSync account with your password alone, even if that password leaks somewhere else. BankSync uses time-based codes (TOTP), the standard that Google Authenticator, 1Password, Bitwarden, Authy, Microsoft Authenticator and most password managers support. There is no SMS option: text messages are the weakest second factor and the easiest to intercept. ## Turn it on **Set up two-step verification** 1. **Open Settings, Security** — Select your avatar, then Settings, then Security. The Two-step verification section shows On or Off. 2. **Select Set up authenticator app** — If you signed in a while ago, BankSync first asks you to confirm it's you with your password (Confirm password) or your Google account (Continue with Google). 3. **Save your recovery key** — BankSync shows your recovery key: eight groups of four characters and a short check group at the end. Copy it into your password manager, download it, or print it. Then type its last two characters to confirm you saved it, and select Next. 4. **Scan the QR code** — Scan the code with your authenticator app. If you cannot scan it, open "Can't scan it? Enter this key instead". Then select Next. 5. **Enter the first code** — Type the six digits your app shows and select Turn on. Until you do, nothing changes: closing the window before this step leaves two-step verification off. Your authenticator is listed on the Security page with the date you added it, the status reads On, and BankSync emails you to confirm the change. ![Settings, Security with two-step verification On: an authenticator app added on 12 September, a line confirming the recovery key was saved, and recent security activity listing the recovery key saved and two-step verification turned on.](https://cdn.banksync.io/screenshots/settings/security-recovery-key.5846c4fd08c9501f.png "Settings, Security once two-step verification is on and your recovery key is saved.") ## Your recovery key The recovery key is the secret your authenticator app uses, written out for you to keep. With it you can: - sign in without your phone: on the code screen choose **Lost your phone? Use your recovery key** and type it in, and your browser turns it into the current code; or - add BankSync to a new authenticator app, by entering the key as a setup key. > **Keep it like a password:** 'Anyone with your recovery key and your password can sign in. Keep it in your password manager or printed somewhere safe, away from your phone. BankSync never stores it and cannot show it to you again.' ![The sign-in step titled Use your recovery key, with a Recovery key field, a note that spaces, dashes and capitals don't matter, a Continue button, a link back to using a code from the app, and a Contact support link for a lost key.](https://cdn.banksync.io/screenshots/settings/recovery-key-sign-in.3b3b233b38de48f2.png "Lost your phone? Use your recovery key on the code screen.") Spaces, dashes and capital letters don't matter when you type it. The last two characters are a check: if you mistype a character, BankSync tells you straight away instead of counting it as a failed attempt. When you sign in with your recovery key, BankSync emails you and asks you to **Secure your account**: replace your authenticator so the key you used stops working. You can do it straight away or select Not now; Settings, Security keeps reminding you until you do. ![The Secure your account page after a recovery-key sign-in: a note that anyone with the key and your password can sign in, steps to set up the authenticator again and save the new key, and Replace authenticator and Not now buttons.](https://cdn.banksync.io/screenshots/settings/secure-account.3a8547037dca73ad.png "After a recovery-key sign-in, replace your authenticator so the key you used stops working.") ## Replace your authenticator Select **Replace** next to your authenticator in Settings, Security. You use it when you have a new phone, when your recovery key was used, or when you set up two-step verification before recovery keys existed and want one. Replacing confirms it's you first, then removes the current authenticator and its recovery key, and walks you through setup again with a new key. Your account allows one authenticator at a time, so the old one stops working as soon as the replacement starts; if you close the window before you finish, two-step verification stays off until you set it up again. ## Signing in with two-step verification After your password or Google sign-in, BankSync asks for the current code from your app. Enter it and you are in. Codes change every 30 seconds; if one is refused, wait for the next. You are also asked for a code whenever BankSync confirms your identity again: when you change your email address, link Google to your account, or remove or replace the authenticator. Every one of those screens also offers your recovery key. ## Turn it off Open Settings, Security, and select Remove next to the authenticator. BankSync always asks you to confirm it's you first (Confirm and remove with your password, or Continue with Google), and that confirmation asks for a code from the app or your recovery key. Only then is the authenticator removed, so someone using a device you left signed in cannot turn two-step verification off. BankSync emails you when it is off. ## Recent security activity Settings, Security lists your recent security activity: when two-step verification was turned on or off, when a recovery key was saved or used, and when BankSync support reset it. Each entry shows what happened and when, nothing more. BankSync emails you for each of these changes as it records them, so you hear about a change you didn't make. A change made from another device shows up, and is emailed, the next time you open Settings, Security. Developers can read the same status and activity over the API, an MCP client or the CLI with the `account:read` permission: see [Your sign-in security over the API](/docs/api/account-security-api). ## Lost your phone and your recovery key? If your authenticator app was backed up (Google Authenticator, Authy, 1Password and most password managers sync between devices), restore it on your new phone instead. If you have neither, select Contact support under "Lost your recovery key too?" on the code screen, or email . After verifying that the account is yours, support removes the authenticator, ends every session (a device that was signed in loses access within the hour), and emails you that it did. Then sign in with your password and set up two-step verification again. ## Email links from BankSync Verification, password-reset and email-change links each work once. A password-reset link expires after one hour and a verification link after three days. If a verification link has expired, the page it opens offers Send a new link while you are signed in; an expired password-reset link offers Send a new link when it still knows your address. Otherwise select Go to sign in and start again: request a new reset from the sign-in page, or change your email again from Settings, Security. Related: [Deleting your account](/docs/account-billing/deleting-your-account).