Two-step sign-in

A second check, on top of your password, entered each time you sign in — either a six-digit code from an authenticator app on your phone, or a six-digit code emailed to you at the moment you sign in.

When you would use this: to add this extra check to your own account, or because the firm you work with requires it of everyone who signs in to their portal.

Setting up the authenticator app: open "My profile" and choose "Two-step sign-in". Scan the code shown with an authenticator app (Google Authenticator, Authy, or similar), then enter the six-digit code it gives you to confirm the two are linked. You will be shown a set of recovery codes — save them somewhere safe; each one lets you sign in once if you lose access to your authenticator app.

Setting up codes by email instead: from the same screen, turn on codes by email. Each time you sign in, a six-digit code is sent to your own email address; it works for ten minutes, once, and a fresh one replaces it if you ask for another. Turning on the app switches email codes off — the two are never both active at once.

If the firm requires it: some firms require every customer to have one of the two methods set up before they can use anything else in the portal; if yours does and you have not set one up, you are shown the setup screen in place of your usual pages until you do. Either method satisfies this.

What happens next: from then on, signing in asks for your password and then a code, by whichever method you set up. Turning either method on or off ends your other signed-in sessions.

When it refuses: an app code that is rejected is usually a clock out of sync on your phone — check the time is set automatically. An email code rejected as not correct or expired means it has already been used, been replaced by a newer one, or its ten minutes are up — send a new one.

Lost your phone and your recovery codes?: use "Contact us" and ask the firm to reset your two-step sign-in — they can clear it from their side, which signs out any device currently using your account, and you set it up again from scratch on your next sign-in.