What MFA is
MFA adds a second step to signing in. After you enter your password, you'll enter a 6-digit code from a free authenticator app on your phone. The code refreshes every 30 seconds, so even if someone else has your password, they can't get into your account without your phone.
Why we're adding it
MFA blocks the vast majority of account takeover attempts. Microsoft's data puts the figure at 99.9% of automated attacks.
A few common questions about other methods:
- SMS codes aren't included because text messages can be intercepted through SIM swapping, where an attacker convinces a carrier to move your number to their device.
- Email codes aren't included because they use the same channel as a password reset. Anyone with access to your inbox could reset your password and grab the MFA code in the same place, which defeats the purpose.
- Authenticator apps generate codes locally on your device, so the codes never travel over a network that could be intercepted.
Who this affects
- Every portal user signing in with email and password.
What you'll need
A free authenticator app on your phone. Any of these work:
| Logo | App Name | Device | Built-in or App Store? | Is it 100% Free? |
|---|---|---|---|---|
| Apple Passwords | iPhone | Built-in (No download needed) | Yes | |
| Google Authenticator | iPhone & Android | App Store / Play Store | Yes | |
| Microsoft Authenticator | iPhone & Android | App Store / Play Store | Yes | |
| Duo Mobile | iPhone & Android | App Store / Play Store | Yes | |
| Twilio Authy | iPhone & Android | App Store / Play Store | Yes | |
|
|
1Password / Bitwarden | iPhone & Android | App Store / Play Store | Only if you already use and pay for it |
Important Note: 1Password and Bitwarden are paid password managers that have built-in free authenticator tools. If you do not already pay for them, please choose Google, Microsoft, Duo, Authy, or Apple Password for a 100% free standalone option. You do not need to pay anything to use MFA on the iGUIDE Portal.
Never used an authenticator app before?
It's just an app, downloaded the same way you'd download any app. It doesn't call, text, or connect to anyone. All it does is show a 6-digit number that refreshes every 30 seconds. No account, subscription, or payment required.
On an iPhone: Open the App Store, search for one of the apps above, tap Get, then Install. Enter your Apple ID password or use Face ID if it asks.
On an Android phone: Open the Google Play Store, search for one of the apps above, tap Install.
Once it's installed, open it and leave it there. You'll come back to it in the next section.
Setting it up
Setup takes about two minutes. You only do it once.
- When you sign in, you'll see a prompt to set up MFA.
- If you start setup, you'll re-enter your password and then see a QR code (a small black-and-white square pattern). Open your authenticator app and look for a "Scan QR code" option, usually a camera or plus icon. Point your phone's camera at the code on your screen. On mobile, you can copy the secret code or tap the link to open the app directly.
- Your app will start showing a 6-digit code that refreshes every 30 seconds. Enter the current code on the portal to confirm everything's connected.
- The last step is recovery codes. You'll get 10 of them, 8-character codes like A3K9-PQ72. Save these somewhere safe before you finish. A password manager works well, or print them and store the page somewhere you'll find it later. You can't finish setup without confirming you've saved them, and you won't see them again after this screen.
iGUIDE Portal showing the 10 recovery codes to save.Recovery codes are not your everyday sign-in code.
They're a one-time-use backup for the single situation where you've lost your phone and can't get your regular 6-digit code. Each one works once, then it's gone for good. Use a recovery code for routine sign-in and you'll burn through all 10 fast, then you're locked out with no backup left. Every day, sign in with the code from your authenticator app. Only reach for a recovery code if your phone is lost, broken, or the app is gone.
Signing in after setup
Sign in with your email and password as usual. The portal will ask for the 6-digit code from your authenticator app. Open the app, type the current code, and you're in. The whole extra step takes about 10 seconds.
What if my authenticator code stops working?
If your authenticator code stops working, or you lose access to your authenticator app, use one of your recovery codes to sign in.
Important: If you use a recovery code to regain access, delete the existing iGUIDE entry from your authenticator app before setting up MFA again. The old iGUIDE entry may continue to appear in your authenticator app, which can cause confusion about which 6-digit code to use.
If you can still access your account
If you can sign in to your iGUIDE account from another device, go to Settings > Security and replace your MFA setup. Before setting up the new authenticator, delete the old iGUIDE entry from your authenticator app. Then scan the new QR code and use the newly generated iGUIDE entry going forward.
If you cannot access your account
If you cannot sign in because your authenticator code is no longer working and you do not have a working recovery code, contact the iGUIDE support team. Support can reset MFA on your account from the backend so you can set it up again.
If you have used all 10 recovery codes, contact support rather than continuing to try old codes.
Do not keep the old iGUIDE entry in your authenticator app when setting up MFA again. Delete the old iGUIDE entry first, then set up the new MFA connection using the QR code provided during setup.
FAQ
Q: Do I need to pay for anything?
A: No. Every authenticator app listed above is free.
Q: What if I lose my phone AND my recovery codes?
A: Contact support. We can reset MFA on your account so you can set it up again on your new device.
Q: What about the mobile capture app?
A: You will be requested to sign in and enter your MFA code when you upload to the portal.
Q: Can I use the same authenticator app for multiple accounts?
A: Yes. Most apps support unlimited accounts. Each one shows up as a separate entry with its own rotating code.
Q: How often will I need to enter a code?
A: On a weekly basis.
Q: My app is open and I am typing the code correctly, but it says "Invalid Code." How do I fix it?
A: Your phone's internal clock is likely out of sync. Go to your phone's system settings (Date & Time) and ensure "Set Automatically" is turned on. You can also look for a "Time correction for codes" or "Sync now" option inside your authenticator app settings.