As of July 25th, 2024, we will no longer offer email as an option for receiving one-time passcodes (OTP) during two-factor authentication (2FA). This change affects the 2FA process when logging in from an unrecognized device.
Available 2FA methods after the change:
- SMS/text messages
- Phone calls
- Authenticator apps (including Google Authenticator and Microsoft Authenticator)
Note: We've recently highlighted the authenticator app option more prominently for users who may have difficulty receiving SMS or phone calls.
Why is this change happening?
We're implementing this change to enhance the security of your account and provide more robust authentication options. While we continually strive to maintain the highest security standards, we've identified email OTP as a potential vulnerability in certain circumstances.
Key reasons for this change:
- To strengthen our overall security posture
- To encourage the use of more secure authentication methods
- To adapt to evolving security best practices in the financial industry
How will this affect me?
If you currently use email for receiving OTPs:
- If not already done you'll need to choose an alternative 2FA method before July 25th, 2024
- After July 25th, you won't see email as an option for OTP delivery
- Your login process will require using SMS, phone calls, or an authenticator app for 2FA
If you already use SMS, phone calls, or an authenticator app for 2FA:
- You won't need to take any action
- Your login process will remain unchanged
Remember:
- This change only affects 2FA when logging in from an unrecognized device
- We've been communicating about this topic through multiple channels, including notifications, account statements, and social media
- It's crucial to keep your contact information and security preferences up-to-date
We encourage all users to review their security settings and consider using an authenticator app for enhanced security. You can update your preferences under "My Settings" > "Login & Security" in your account.