Multi-factor authentication (MFA) protects your Selfwealth account by asking for a 6-digit code as well as your email and password. There are three ways to receive a code:
- Authenticator app (most secure, recommended): a code from an app such as Google Authenticator or Microsoft Authenticator. It works without mobile coverage.
- SMS passcode: a code sent by text to your registered Australian mobile number.
- Email code: if you haven’t set up an authenticator app or SMS passcode, we send a code to your registered email. Email codes can’t be turned off. If someone gains access to your email, they could use the code to reach your account, so we strongly recommend setting up an authenticator app.
When will I be asked for a code?
You won’t be asked every time you log in. We ask for a code when:
- you log in from a new device or browser
- you use private or incognito browsing
- you’ve cleared your cookies
- the remembered-browser period has ended
You’ll also be asked to confirm it’s you before account changes, including:
- updating your nominated bank account, mobile number, email or password
- turning MFA methods on or off
- merging logins
- updating account details
What does “Remember this browser” do?
Tick Remember this browser when you enter your code, and we won’t ask again on that browser for 30 days. You’ll be asked again if you clear cookies, use private browsing, or switch browser or device. Some browser privacy settings can stop the browser being remembered.
How do I set up an authenticator app?
MFA can only be set up in the Selfwealth web app. Once it’s on, it also applies to the Selfwealth mobile app, and you’ll need to log in to the mobile app again.
- Log in to the Selfwealth web app.
- Go to the MFA settings:
- New web app: select your profile icon (top right), then Account settings, then Profile, then scroll to Multi-factor authentication.
- Classic web app: select Settings, then the Personal Details tab.
- Select Enable Authenticator. We’ll send you a code by email or SMS to confirm it’s you.
- Save your 10 recovery codes somewhere safe before closing the window.
- Scan the QR code with your authenticator app and enter the 6-digit code it shows.
How do I set up an SMS passcode?
- In the same Multi-factor authentication section, select the SMS passcode option.
- Confirm or add your Australian mobile number.
- Enter the code we text you.
If you’d rather, a Customer Advocate can set up SMS passcode for you over live chat or phone, using the mobile number already on your account.
Which method will I be asked for, and can I turn MFA off?
- If you have both an authenticator app and SMS passcode, we’ll ask for your authenticator code.
- You can turn off the authenticator app, but you’ll need a current code from it to do so.
- SMS passcode can’t be removed once it’s on, but you can update the number.
- Email codes can’t be turned off.
What are recovery codes and how do I use them?
Recovery codes let you log in if you can’t get an authenticator code.
- When you’re asked for your authenticator code, select Log in with a recovery code and enter one code.
- Each code works once.
- To get a new set, select Reset Recovery Codes in your MFA settings. This cancels your old codes.
- Turning off the authenticator also cancels your codes.
I’ve got a new phone. How do I move my authenticator?
- You still have your old phone: log in, turn off the authenticator using a code from the old phone, then select Enable Authenticator and set it up on the new phone. You’ll get a new set of recovery codes.
- Your app supports transfer or cloud backup: some authenticator apps can move your accounts to a new phone. Check your app’s help pages.
I’ve lost my phone or can’t get my authenticator code.
- You have a recovery code: log in with it, then turn off and set up the authenticator again, or ask a Customer Advocate to reset it on our live chat or phone line.
-
You don’t have your phone or recovery codes: a Customer Advocate can reset your MFA once they’ve confirmed your identity. You’ll be asked some questions about your account. After the reset:
- Log in using the code sent to your email.
- Set up your authenticator again.
- Delete the old Selfwealth entry from your authenticator app.
I no longer have the mobile number linked to my SMS passcode.
A Customer Advocate can update your number once they’ve verified your identity. This includes a biometric check.
My code isn’t working, or I didn’t get one.
- Authenticator: codes change every 30 seconds and each one works once. If a code is rejected, wait for the next one. Set your phone’s date and time to automatic, and make sure you’re using the Selfwealth entry you set up most recently.
- SMS and email: you can request a new code after 30 seconds. SMS codes expire after 5 minutes and email codes after 10 minutes. Check your spam or junk folder, and make sure your phone has coverage.
- Too many attempts: after several incorrect codes you may need to wait 15 minutes before trying again.
I received a code I didn’t ask for.
Someone may know your password.
- Don’t share the code with anyone. Selfwealth will never ask you for it.
- Change your password straight away.
- Contact a Customer Advocate so we can check your account.
Which code is this email asking for?
- A code after you signed up verifies your email address.
- A code when you log in or make an account change is an MFA code.
- A link after changing your email confirms the new address.
Need help?
Our Customer Advocates can reset MFA and update your details between 10am to 6pm Monday to Friday on our phone line or live chat. If you’re chatting with our virtual assistant, ask to speak to a Customer Advocate.