What is 2FA? And why do I suddenly have to log in with an extra step?
You've probably already experienced it yourself. Where you used to only need your email address and password, nowadays you must enter an extra code via an app on your phone. It can also happen that you complete the extra verification via an email with a verification code. This extra step is called two-step verification, or 2FA. That can take some getting used to. Why is that actually necessary? And how does it work exactly? We're happy to explain.
Hackers are increasingly trying to break into company accounts. For example, customer data, bank account numbers, or other confidential information can be stolen. That can have big consequences for both businesses and customers.
Just a username and password often aren't enough protection anymore. Passwords can be retrieved by hackers in several ways. That’s why more and more companies choose an extra check during login. This extra check is called 2FA.
What is 2FA?
2FA stands for Two-Factor Authentication, in Dutch two-step verification. That means logging in with two ways to verify that you really are the person who should have access.
- The first step is your email address and your password
- The second step is a unique code you get via an authenticator app on your phone or tablet, an SMS message, or an extra email
- Only if both steps are correct can you log in
This helps keep your data—and the company's data—much better protected.
Which authenticator apps can you use?
There are several apps that do the same thing. Some well-known examples are:
How do you log in with 2FA?
It only takes a few simple steps.
Are you using an authenticator app?
Then open the app on your phone with your PIN, fingerprint, or facial recognition. On the relevant website you see a six-digit code. This code changes automatically after a short time, usually after about one or two minutes. Enter the code before it changes. If the code has expired, just use the new code that appears in the app. After entering the code you’re securely logged in.
Did you choose email verification the first time you logged in?
Then you’ll receive the verification code in your inbox. Enter this code to log in securely. You’re now securely logged in.
Why does that code keep changing?
That’s exactly the point.
Each code is valid for only a very short time. That way, someone else can do almost nothing with it if the code ends up in the wrong hands. After a short time, a new code automatically appears in the app.
How often should you log in via 2FA?
Usually you use the authenticator app every time you log in again. If you’re inactive for a while or you close the system? Then you’re often automatically logged out. That’s to better protect your data. On the next login you’ll again use a new code.
Isn’t this a bit much?
No. In fact, it makes a huge difference. Microsoft studied billions of login attempts and found that more than 99 percent of account attacks can be prevented when people log in with multiple steps, such as 2FA. It also showed that more than 99.9 percent of hacked Microsoft accounts did not use any extra authentication at login. With 2FA, an attacker with only one password is not enough. That person would also need your phone or access to your authenticator app. That makes it much harder for criminals to get in.
Keep your data safe
If you use an authenticator app, handle it with the same care as your password.
Never share a verification code with anyone. Not even if someone says they are from the help desk, the bank, or a supplier. A trusted organization will never ask you to share such a code.
Think someone has gained access to your account or you don't trust a situation? Contact the organization you're logged into as soon as possible. Change your password immediately and check that there are no unknown devices or login attempts visible.
A little extra step when logging in may take a few seconds. But those few seconds can prevent a lot of problems. Also read how pay safely via Buckaroo works.
What is SSO?
Maybe you’ve heard the term SSO pop up alongside 2FA. SSO stands for Single Sign-On. With SSO you log in once through a trusted environment. Then you automatically gain access to multiple applications for which you have rights, without having to log in again each time.
At Buckaroo, SSO is currently only available to users of Buckaroo Plaza. Are you using My Buckaroo? Then you don’t log in via SSO, but the 2FA security stays the same. So you continue to use the code you receive via the authenticator app or via the extra email, as explained at the start of this blog.
What is the difference between SSO and 2FA?
SSO and 2FA each have a different purpose. SSO increases ease of use by giving you access to multiple applications after a single login.
2FA makes logging in more secure by adding an extra verification step.
These techniques complement each other, but they’re not dependent on each other. You can log in securely with only 2FA, as in the My Buckaroo environment. At Buckaroo Plaza, SSO and 2FA are combined: you log in once and then confirm your identity with an extra verification step. That way you get the benefits of both ease of use and an extra layer of security.
Frequently Asked Questions
Do I also have to log out again?
No, you’ll be automatically logged out if you’re inactive in the area you’re logged in to.
What should I do if I have lost the device that has the app on it?
Can't log in anymore because the authenticator app was on your lost or stolen phone? Then contact the administrator of your organization or the Buckaroo Support department. After your identity has been verified, the two-step verification can be reset, so you can set up the authenticator app on a new device and regain access to the Buckaroo Portal.
What should I do if the code has expired?
You can simply use the new code that appears in the app.
What should I do if I have entered the wrong code too many times?
If you have entered the wrong password too many times, your account is temporarily locked for security reasons. First use the 'Forgot password' option if you don't remember your password. If the problem persists, please contact the administrator of your organization or the Buckaroo Support department for further assistance.
