Two-step verification adds a second check when you sign in to Debitura: after your password, you enter a six-digit code from an authenticator app on your phone. Someone who learns your password still cannot get in without your phone.
It is optional for each person, unless a company you belong to requires it. One setting covers your whole Debitura login, across every company you belong to.
Not the same as the contract-signing code
When you sign the Standard Debt Collection Agreement, Debitura emails you a six-digit code to confirm the signature. That is a different feature, explained in Clients: Email verification issues and fixes. Two-step verification uses an app on your phone, not email, and it is asked when you sign in.
What you need
An authenticator app on your phone, such as Microsoft Authenticator or Google Authenticator. Any standard authenticator app works. The app shows a new six-digit code every 30 seconds.
Somewhere private to keep ten recovery codes, such as a password manager. They are shown only once, during setup.
Debitura does not send sign-in codes by text message or email.
Set up two-step verification
Open Profile Settings from the user menu. On the Two-step verification card, which shows Off, choose Set up.
If you signed in more than five minutes ago, you are first asked for your password. Enter it and choose Start setup.
Have the authenticator app ready on your phone and choose Show QR code.
In the authenticator app, add an account and scan the QR code. If scanning does not work, choose Enter a setup key instead and type the key into the app.
Enter the six-digit code the app now shows for Debitura and choose Connect app.
Save the ten recovery codes, for example with Download recovery codes. They cannot be shown again.
Tick I saved these codes and choose Finish setup.
The card now shows On, and an email confirms that two-step verification is on.
Sign in with a code
Once two-step verification is on, every new sign-in asks for a code after your password. There is no option to remember a device.
The workday option still works. Ticking it when you sign in still gives you a session of up to 12 hours.
Each code works once. If a code was just used, for example a moment ago in another tab, it is refused. Wait for the next code in the app.
Codes depend on the time. If every code is refused, check that your phone sets its clock automatically.
Too many wrong codes. After five wrong codes the attempt closes and you start again. After ten wrong codes within 30 minutes, two-step verification pauses for 30 minutes.
Several companies? After the code, choose which company to open.
Sign in with a recovery code
If you do not have your phone, choose Use a recovery code on the code screen and enter one of your saved recovery codes. Each recovery code works once. After you sign in, connect a new phone or get new recovery codes (see below).
Change your two-step verification settings
All changes start in Profile Settings: on the Two-step verification card, choose Manage. Some changes ask you to confirm it is you with a code from the app. If you signed in more than five minutes ago, a change may also ask for your password.
Move to a new phone or authenticator app
In Manage, choose Change authenticator app.
Enter your password if asked, and one unused recovery code.
Set up the new app in the same way as in steps 3 to 7 of the setup above.
You do not need the old phone. You get new recovery codes, and an email confirms the change.
Get new recovery codes
In Manage, choose Get new recovery codes when your codes are lost or nearly used up. The old codes stop working at once, and an email confirms it.
Turn two-step verification off
In Manage, choose Turn off two-step verification and confirm it is you. After that, your password alone opens your account, your recovery codes stop working and your other signed-in sessions end. An email confirms it.
You cannot turn it off while any of your companies requires it, including during that company's seven-day notice period. The Manage dialog then names the company that requires it instead.
When your company requires it
A company admin can require two-step verification for everyone on the team.
You get an email with the date and time it takes effect: seven days after the company turned it on.
A reminder follows in the last 24 hours before the deadline, if you have not set it up yet.
Until the deadline nothing changes, except that you can no longer turn your own two-step verification off.
After the deadline you cannot open that company until you set it up. You are asked to set it up when you sign in or open the company, even if you were already signed in. Your other companies are not affected.
New team members of a company that already requires it set it up before they get in.
If the company removes the requirement, you get an email. Your own two-step verification stays on unless you turn it off.
For company admins: require it for your team
The setting is in Account Settings → Security, where the Two-step verification card shows Required or Not required.
To turn it on, first set up two-step verification on your own account. Then choose Require two-step verification and confirm a code. The page shows the date it takes effect, seven days from now, and every team member is emailed straight away.
To see who has it on, choose Show who has it on and confirm a code. The team list shows on or off for each person.
To remove the requirement, choose Remove requirement and confirm a code. Every team member is emailed. Anyone who turned it on keeps using it.
Debitura can do this for you. If you ask support to turn the requirement on or off, we record your request and make the change. The same deadline and emails apply.
The requirement applies only to your company. It does not change anyone's access to other companies they work with.
Lost your phone and your recovery codes
Without the app and without a recovery code, you cannot sign in, and you cannot remove two-step verification yourself. Resetting your password does not remove it either.
Choose Contact support on the code screen after your password, or email [email protected].
We confirm who you are first, including with an authorized contact at your company. This takes time, so there is no instant access.
We never ask for a code from your app, a recovery code, your password or the setup key. Never send them to anyone, including Debitura.
After the reset, all your sessions end. You sign in again with your password and set up a new authenticator app before you can open anything. An email confirms the reset.
Emails you receive
All come from Debitura ([email protected]) to your login email.
When | Subject |
You set up an authenticator app, or change it | Two-step verification is on for your Debitura account |
You turn two-step verification off | Two-step verification is off for your Debitura account |
You get new recovery codes | New recovery codes for your Debitura account |
Support resets it for you | Your Debitura authenticator was reset by support |
Your company turns its requirement on (with the deadline) | Set up two-step verification for your company |
Your company turns its requirement off | Your company's two-step verification requirement is off |
Your company's deadline is less than a day away and you have not set it up | Reminder: Set up two-step verification for Debitura |
If you get one of these emails and you did not make the change, contact [email protected] straight away.