Two-factor authentication and your recovery codes

Two-factor authentication means signing in takes your password and a six-digit code from an app on your phone. Someone who learns your password still cannot get in.

It is optional for the account as a whole, and required before you connect a bank. A bank connection brings your transactions and balances into TALISK_HQ, and a password on its own is not enough to stand in front of that.

Turn it on

1. Go to Settings › My Account, section Two-Factor Authentication.
2. Click Enable Two-Factor Authentication.
3. Scan the QR code with an authenticator app on your phone: Google Authenticator, Authy, 1Password and Microsoft Authenticator all work. If the camera will not cooperate, open Can't scan? Enter manually and type the key in by hand.
4. Enter the six digits the app is showing under Verification code and click Verify & Enable.
5. TALISK_HQ shows your recovery codes. Save them before you carry on, as described below.

Turning it on signs you out everywhere else, so any other browser or device signs in again with a code. The QR code is drawn in your own browser; the key behind it never leaves TALISK_HQ.

Each six-digit code works once. If a sign-in is refused straight after another one, wait for the app to show the next code.

To move to a new phone or a different app, turn two-factor authentication off and set it up again. TALISK_HQ will not replace the key while it is on.

Your recovery codes

You get eight of them, and they are the way back into your account if you lose the phone with your authenticator app on it. Each one works a single time.

They are shown once and never again. TALISK_HQ keeps only a scrambled copy, so this is not a case where support can read them out to you later: nobody here can see them. Use Copy to put them on the clipboard, or Download to save them as a file. Keeping them in a password manager is ideal. Keeping them only on the same phone as the authenticator app is not, because losing that phone then costs you both at once.

TALISK_HQ will not let you leave the screen until you say you have saved them. That is deliberate, and it is the one time we get in your way on purpose.

Signing in once it is on

Enter your email and password as usual. TALISK_HQ then asks for a Two-factor code: open your authenticator app and type the six digits it shows for TALISK_HQ. The code changes every thirty seconds, so if it is about to roll over, wait for the next one.

If you have added a passkey, the same screen shows Use passkey above the code box. Tap it and confirm with Face ID, Touch ID or your device PIN; there is no code to find or type. The code box stays underneath for any device without your passkey.

After you sign in with a code, TALISK_HQ may offer Skip the code next time. Choose Add a passkey to set one up on that device, or Not now to carry on; the offer then stays away from that device for a month. You can also add one any time in Settings › Account › Passkeys.

Passkeys work at taliskhq.com. On talisk.ai and in the desktop app, sign in with your code for now.

The check on the sign-in screen

The sign-in and sign-up screens carry a small automatic check from Cloudflare that tells a person from a script trying passwords. Usually it passes on its own and you see nothing more than a tick. If it asks you to confirm, do so and then sign in.

If sign-in says Verification failed. Please try again., reload the page so the check runs again, then sign in. A browser extension that blocks third-party content can stop the check from loading; allow challenges.cloudflare.com, or try another browser. In the desktop app, an old version may ask you to update before the check can load.

If you lose your authenticator app

On the code screen, use Lost access to your authenticator? Use a recovery code. Enter one of your saved codes and you are in. That code is then spent, so once you are signed in, generate a fresh set.

If you have lost your recovery codes too

There is a way back, and it starts from the sign-in screen. Sign in with your email and password as usual, and on the code screen follow Lost access to your authenticator? Use a recovery code, then Don't have a recovery code? Verify your identity instead.

TALISK_HQ shows the email address you signed in with, then shows you a number between one and five. Photograph two things: your government photo ID, and yourself holding up that many fingers. The number is what proves the selfie was taken just now, for this request, so take the photo after you see it rather than using one you already had.

Send them, and a person here checks the ID against your account. This is not instant, and it is not meant to be: it is the only step standing between a stranger and your books. You get an email when it is decided.

On a Partner account, which reaches every client's books, the photos are not enough on their own: we also confirm who you are directly, usually on a call, before your request is approved.

When it is approved, two-factor authentication is switched off on your account so you can sign straight in with just your email and password. Turn it back on and save the new recovery codes before you carry on.

TALISK_HQ keeps the two photos encrypted, uses them only to confirm who you are, and destroys them 90 days after the decision. The record that you asked and what was decided is kept.

If you have also lost access to the email inbox you sign in with, the code screen offers Move your account to a new address instead. See Lost access to the email you sign in with.

If the photos are hard to read, or the selfie does not show the number of fingers we asked for, the request is turned down and you can get in touch directly.

Get a new set of recovery codes

Go to Settings › My Account and click Generate new recovery codes. Confirm your password, and the new set appears. Save it the same way.

Do this whenever you have used one, whenever you are not certain your saved copy is still somewhere you can reach, or if you were never shown a set in the first place. Generating a new set replaces every unused code you had, so an old list you no longer trust stops working the moment you do it.

Your existing codes cannot be recovered or re-displayed, only replaced. That is the same property that makes them safe to store, so replacing them is the answer whenever there is any doubt.

Turn it off

Settings › My Account, then Turn off 2FA. TALISK_HQ first says what changes, and you press Turn off two-factor; then you confirm your password. Signing in then asks for your password only, and the TALISK_HQ code in your authenticator app stops working, so turning it back on means setting it up from the start.

Turning it off deletes your recovery codes along with it, which is what you want: they are no use without the app they back up, and leaving them alive would be a surprise the next time you switch two-factor authentication on. You get a completely new set when you do.

Bear in mind that you cannot connect a bank while it is off. Existing bank connections carry on working normally.

If you use a passkey

TALISK_HQ will not let you turn two-step verification off while you have a passkey enrolled, and it says so when you try. Remove the passkey first, in Settings › Account › Passkeys.

Your authenticator code is the route that works on a device where a passkey does not, so taking it away while a passkey is your only way to confirm could leave you unable to approve a bill or send an invoice. See Confirm a money action with a passkey.