Two-step sign-in
Ask for a code from your phone as well as your password, so a stolen password is not enough to get in.
Two-step sign-in asks for a six-digit code from an authenticator app on your phone each time you sign in, as well as your password. Someone who learns your password still cannot get in without your phone.
It is optional, and each person turns it on for their own account. It is worth it for an owner: your account holds your business's bank details and books.
Turn it on
You need an authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator or 1Password.
- Press your initials at the top right, then Sign-in and security. If you are an owner, you can instead press Turn on two-step sign-in on My details.
- Go to Security. Under Two-step verification, press Add two-step verification and choose Authenticator application.
- Scan the QR code with your authenticator app, then type the code the app shows.
- Save the backup codes it gives you somewhere safe, away from your phone, such as a password manager or a printed copy. Each one gets you in once if you lose your phone.
From then on, after your password you are asked for the code from the app.
Owners see a Protect your account box on My details until it is on. To hide the box without turning it on, press the X on it; it stays hidden on that device.
If you lose your phone
Sign in with one of your backup codes instead of the app's code, then go back to Sign-in and security, Security, and set up the authenticator app on your new phone. You can make new backup codes there too.
Without your phone or a backup code, contact us. See Where do I get help?
Google and Microsoft sign-in
If you sign in with Continue with Google or Continue with Microsoft, that account is the way in, so turn on two-step sign-in with Google or Microsoft as well.
Turn it off
Go to Sign-in and security, Security, and remove the authenticator app under Two-step verification.