Two step login, and what happens if you lose your phone

Your shop is your income, and one password is all that protects it. Two step login adds a code, so a stolen password on its own is not enough.

Read the section on losing your phone before you turn anything on. It decides which method you should pick.

Turning it on

In the seller dashboard, open Settings, then Account, and find Two-factor authentication. Status reads Not enabled, with an Inactive badge, until you set it up.

There are two methods.

Authenticator App shows a QR code to scan with an authenticator app on your phone. You then type the 6 digit code the app shows to confirm. The app makes its codes on the phone itself, so it does not need a signal.

Email OTP sends a code to your email address each time you log in. There is no confirm step. The moment you press it, it is on. It is only as safe as your email account, and you need to be able to open that inbox.

Once it is on, the badge reads Active and Status names the method you chose.

The Two-factor authentication section showing Status, an Active badge and the method in use — Once it is on, the badge reads Active and names the method.

Logging in afterwards

After your password you get a Verify your identity screen with a Verification code box. On email you also get Resend code. An email code expires after 10 minutes. Five wrong codes cancel the attempt and you log in again from the start.

The same screen has a checkbox: Trust this device for 90 days. Tick it on your own computer and that computer will not ask for a code for 90 days. Never tick it on a shared or borrowed computer.

Trusted computers are listed under Trusted devices in the same section of Account. Each row has Remove, and Remove all devices clears the list.

The Trusted devices list, each row showing the device, where it connected from, when it was last used and when it expires — Each trusted device shows when it was last used and when it expires.

If you lose your phone

Know this before you choose a method. There are no recovery codes.

If you are on the authenticator app and the phone is gone, you cannot get a code. The login screen only accepts the method your account uses, so an authenticator account cannot fall back to an email code. Turning two step login off also asks for a valid code, so that does not help either.

A trusted device still logs in without a code. That gets you into your dashboard, so you can keep running the shop. It does not change the method, because the only control on that screen is to turn it off, and that asks for a code too. After that, contact support.

Two things follow.

Tick Trust this device for 90 days on the computer you own. It costs nothing, and it is the only thing that gets you in when the phone is gone.

If you lose phones, share one, or change handsets often, pick Email OTP. You can read email on any device, which is what you need when the phone is gone. The authenticator app is the stronger of the two. Choose it if your phone is reliably yours.

Turning it off

When it is on, the section shows Disable 2FA. It asks for your current verification code. Turning it off also removes every trusted device, so if you turn it on again, every computer asks for a code again.

Start your store at berkedai.com