Our customers occasionally have their account passwords compromised, usually by falling victim to phishing or malware. Using SSO with Xero + two-step authentication significantly reduces the risk of unauthorised access to your account as the attacker can only get "the something they know" (like your login and password), hackers can't usually get "the something they possess" (like the unique passcode generated by the app on your phone), so they can’t log in. This better protects yourself from fraud and damage to your business. 

Our lives are increasingly digital but many people still use and share weak passwords that are easily guessed, or fail to keep software and anti-malware up to date. For this reason, two-step authentication is being used more and more in everyday situations where security and privacy are important, including access to online banking and email.

What may appear to be temporarily inconvenient has been proven to significantly reduce the risk and inconvenience of a compromised account.

Yes, you’ll be able to use your Xero login on your mobile device (iOS and Android). But first, you will need to set up Xero login and 2SA (if applicable) on the web application. Then make sure to upgrade to the latest iOS or Android version to use your Xero login on your mobile.

No. Once the authenticator app is installed and set up on your mobile device, it doesn’t need a mobile or wireless connection to work. Because it’s continually generating new codes that are only valid for 30 seconds, it doesn’t need to connect to anything.

What you do need to make sure of though, is that the time on your authenticator device is in sync with Xero. Xero uses an automatic clock service to set the time, as do most mobile phone service providers, so we recommend you allow your network provider to set the time automatically. Manually setting the time can lead to out-of-sync issues and an Invalid code error