Multi-Factor Authentication

If you have lost your recovery codes, you can generate new recovery codes in your MFA settings. Once you generate new recovery codes, the old lost codes will be invalid.

Always store recovery codes in a safe place to ensure account recovery in case of lost access to your primary authentication methods.

If your Passkey is on a different device from the one you're trying to access your account on, make sure the device with the Passkey is in close proximity to the device you are using to access your account. For example, if your Passkey is on your mobile phone and you're attempting to access your account from your laptop, ensure that your mobile phone is physically nearby your laptop during the authentication process. This close proximity is necessary to verify your presence and enhances the security of the authentication process, ensuring it's only you accessing your account.

Some browsers or devices do not support Passkeys. In this case, choose one of your alternative authentication methods to access your account.

To use Passkeys for authentication, use the latest version of Chrome, Safari, or Edge.

If an option to set up Passkeys does not appear in your MFA settings, this could be because the device, or the browser, you are using does not support Passkeys.

The latest versions of Chrome, Safari and Edge support Passkeys. To make sure you can use Passkeys across as many of your devices as possible, keep your browser version up-to-date.

If you set Passkeys as your default MFA method, there are occasions where you may be signing in from a different device or browser that does not support Passkeys. In this case, you will be prompted to use an alternative authentication method.

To remove an MFA method from your account, simply visit your profile page and find the multi-factor authentication section. Click the 'Manage your MFA options' button, and then select the MFA method you want to remove. You'll see an option to remove the authentication method.

Please note that you cannot remove text verification or Email magic link from your MFA methods as there must be at least one authentication method active on your account to guarantee a minimum level of account security.

You have a maximum of 10 attempts to enter the correct authentication code. If you exceed these attempts, your account will be locked for a duration of 10 minutes. After the lockout period, you can make another attempt to enter the code.

To avoid any issues, please ensure that you are accurately typing the 6-digit code.

If you are using an authenticator app, you might need to resync it to ensure its accuracy.

To resync the authenticator app, follow these steps:

1. Open the authenticator app on your device.
2. Access the app's settings or options.
3. Look for an option resembling "resync" or "sync time".
4. Tap on the "resync" option to update the app's time settings.

Resyncing the authenticator app ensures that the time-based codes it generates work accurately, helping to avoid authentication errors and keeping your account secure.

If you are having trouble getting into your account you can call us 24/7 on 0800 737 000, or if you're calling from outside of New Zealand, find your nearest contact centre number here.