Why your account needs an authenticator app
A password alone is not enough for an account that holds card details. Here is what an authenticator adds, and how to set it up without stress.
Jump to a part
Every account here has to be linked to an authenticator app before it can be used, and there is no setting to turn that off. Some people find that strict at first. The reason is simple: your account is where your card details live, and a password on its own is a weak lock for something that can spend money. Here is what the authenticator does, how it gets linked, and how you stay in if the phone disappears.
What a password alone can't protect
Passwords leak in more ways than most people expect. They get reused across sites, typed into convincing fake login pages, saved in browsers on shared computers, or exposed when another service is breached. Once someone has your password, nothing else stands between them and an account protected by a password alone.
An account with card details is an attractive target. With access, someone could reveal a card's number, expiry and CVV and use them before you notice. That is the risk the authenticator removes.
How an authenticator works
An authenticator app — Google Authenticator, Authy, 1Password and many others — holds a secret that it shares with your account. Twice a minute, the app mixes that secret with the clock and derives a fresh six-digit code. Our server runs the identical sum. When both results agree, you are who you say you are.
This has a few useful properties:
- The code changes constantly. A code someone sees over your shoulder is useless a minute later.
- The secret never travels. After setup, the secret stays on your phone and on our server. Nothing is sent by text message that could be intercepted or redirected.
- It works offline. The app does not need a signal to generate codes.
Where you'll be asked for a code
You enter a code each time you sign in, and again whenever you reveal a card's full details in the Cards tab. Revealing details shows the full number and CVV for one minute, then hides them again. Our guide on revealing card details safely goes through that step.
Setting it up
Setup happens right after you confirm your email address. The steps are short:
- Install an authenticator app on your phone if you do not have one.
- In the app, add a new account and scan the QR code shown on the setup page. If you cannot scan, type in the setup key shown under the code.
- Type the six digits that appear in the app; that proves the link works.
- Save your recovery codes — a list of one-time codes shown once at the end of setup.
The full registration flow is covered in the guide to opening an account.
Keep the setup key private
The QR code and setup key are the secret itself. Anyone who has them can generate your codes. Do not screenshot them into shared cloud folders or send them to anyone. If you think the key has been seen by someone else, contact support so the authenticator can be reset and linked again.
Recovery codes: your spare key
Recovery codes exist for the day your phone is lost, broken or replaced. Each code works once instead of an authenticator code. Store them somewhere separate from your phone: a password manager, a printed sheet in a drawer, an encrypted note.
You can create a new set of recovery codes from the Security page whenever you like, using a code from your authenticator. Creating a new set makes the old ones stop working, so replace any stored copies when you do.
If you lose access
If your phone is gone:
- Get in with your password plus a recovery code.
- Open a help ticket asking for the authenticator to be reset.
- After the reset, you link a new phone by scanning a fresh QR code at your next sign-in.
Lost the phone and the recovery codes? Email support from the address your account uses. The team will need to confirm your identity before resetting anything, which takes longer — another reason to keep those codes safe.
Moving to a new phone
A new phone is the most common reason people lose access, and it is completely avoidable with a little planning.
Before you wipe or trade in the old phone, check how your authenticator app handles transfers. Some apps can back up their accounts to the cloud or move them to a new device directly; others cannot, and each account has to be set up again. If your app can transfer, move everything, open the app on the new phone and confirm it shows codes for your account before you reset the old one.
If your app cannot transfer, keep the old phone working until you are signed in on the new setup. Then sign in with a recovery code, open a help ticket to have the authenticator reset, and link the new phone when prompted.
Either way, check that you still know where your recovery codes are. They are the safety net for exactly this moment, and it is much easier to confirm that before the old phone is gone than after.
Why it can't be switched off
Optional two-factor sign-in tends to be switched off by exactly the accounts that need it most. Making it mandatory means every account has the same protection, and it also means our staff never need to be talked into “just this once” exceptions. The same rule applies to the team: back-office accounts require an authenticator too.
The How it goes page shows where the authenticator fits into ordering, paying and using a card.
Quick answers
Which authenticator app should I use?
Any app that supports time-based codes (TOTP) works. Choose one you trust and that you can back up or move to a new phone.
Can I use text-message codes instead?
No. Codes by text message can be intercepted or redirected through SIM swaps, so they are not offered.
My codes are always rejected. Why?
Authenticator codes depend on accurate time. Let your phone take its date and time from the network, then use the newest code.
Will staff ever ask for my code?
Never. Nobody from TopUpVCC asks for your password, authenticator codes or recovery codes. Anyone who does is trying to get into your account.
Summary
An authenticator turns a stolen password into a dead end. Set it up during registration, keep the setup key private, store your recovery codes away from your phone, and expect a code at every sign-in and every card reveal. It is a few seconds of effort that protects everything in your account.
