What MFA is
MFA adds a second step to signing in. After you enter your password, you'll enter a 6-digit code from a free authenticator app on your phone. The code refreshes every 30 seconds, so even if someone else has your password, they can't get into your account without your phone.
Why we're adding it
MFA blocks the vast majority of account takeover attempts. Microsoft's data puts the figure at 99.9% of automated attacks.
A few common questions about other methods:
- SMS codes aren't included because text messages can be intercepted through SIM swapping, where an attacker convinces a carrier to move your number to their device.
- Email codes aren't included because they use the same channel as a password reset. Anyone with access to your inbox could reset your password and grab the MFA code in the same place, which defeats the purpose.
- Authenticator apps generate codes locally on your device, so the codes never travel over a network that could be intercepted.
Who this affects
- Every portal user signing in with email and password.
What you'll need
A free authenticator app on your phone. Any of these work:
- Google Authenticator
- Microsoft Authenticator
- Duo Mobile
- Authy
- 1Password
- Bitwarden
Any standard TOTP app will work. If you already use one for another service, use that.
Never used an authenticator app before?
It's just an app, downloaded the same way you'd download any app. It doesn't call, text, or connect to anyone. All it does is show a 6-digit number that refreshes every 30 seconds. No account, subscription, or payment required.
On an iPhone: Open the App Store, search for one of the apps above, tap Get, then Install. Enter your Apple ID password or use Face ID if it asks.
On an Android phone: Open the Google Play Store, search for one of the apps above, tap Install.
Once it's installed, open it and leave it there. You'll come back to it in the next section.
Setting it up
Setup takes about two minutes. You only do it once.
- When you sign in, you'll see a prompt to set up MFA.
- If you start setup, you'll re-enter your password and then see a QR code (a small black-and-white square pattern). Open your authenticator app and look for a "Scan QR code" option, usually a camera or plus icon. Point your phone's camera at the code on your screen. On mobile, you can copy the secret code or tap the link to open the app directly.
- Your app will start showing a 6-digit code that refreshes every 30 seconds. Enter the current code on the portal to confirm everything's connected.
- The last step is recovery codes. You'll get 10 of them, 8-character codes like A3K9-PQ72. Save these somewhere safe before you finish. A password manager works well, or print them and store the page somewhere you'll find it later. You can't finish setup without confirming you've saved them, and you won't see them again after this screen.
iGUIDE Portal showing the 10 recovery codes to save.Recovery codes are not your everyday sign-in code.
They're a one-time-use backup for the single situation where you've lost your phone and can't get your regular 6-digit code. Each one works once, then it's gone for good. Use a recovery code for routine sign-in and you'll burn through all 10 fast, then you're locked out with no backup left. Every day, sign in with the code from your authenticator app. Only reach for a recovery code if your phone is lost, broken, or the app is gone.
Signing in after setup
Sign in with your email and password as usual. The portal will ask for the 6-digit code from your authenticator app. Open the app, type the current code, and you're in. The whole extra step takes about 10 seconds.
What if I lose my phone
Use one of your 10 recovery codes to sign in. Each code works once. After signing in, go to Settings, then Security, to set up MFA on your new device and generate a fresh set of recovery codes.
If you've used all 10 codes, you can regenerate a new set at any time from Settings, then Security.
Still stuck? Contact support and ask for a walkthrough — we're happy to get on a call and do this together step by step.
Replacing your authenticator (new phone, new app)
You can swap your MFA device whenever you want, as long as you still have access to the current one. Sign in, go to Settings, then Security, and replace the existing setup. You'll scan a new QR code from the new device.
For security reasons, you can't fully remove MFA from your account once it's set up. You can only replace it. If you lose access to your authenticator and your recovery codes, support has to reset it for you.
Dates to know
July 6, 2026: MFA becomes required. You won't be able to sign in without it after this date.
FAQ
Q: Do I need to pay for anything?
A: No. Every authenticator app listed above is free.
Q: What if I lose my phone AND my recovery codes?
A: Contact support. We can reset MFA on your account so you can set it up again on your new device.
Q: What about the mobile capture app?
A: You will be requested to sign in and enter your MFA code when you upload to the portal.
Q: Can I use the same authenticator app for multiple accounts?
A: Yes. Most apps support unlimited accounts. Each one shows up as a separate entry with its own rotating code.
Q: How often will I need to enter a code?
A: On a weekly basis.
Comments
0 comments
Please sign in to leave a comment.