Two-step verification for every sign-in
A password alone is easy to steal. Two-step verification adds a second check when someone signs in: a code from an authenticator app, a code by text message, or a passkey. Recovery codes cover a lost phone, and you can require it for everyone in the business.
Two step verification in SeroPOS
Authenticator app
Scan a QR code with an authenticator app and type the code it shows when you sign in.
Text-message codes
Receive a sign-in code by SMS on your mobile phone instead.
Passkey sign-in
Use a passkey on your device as the second step, with no code to type.
Recovery codes
Ten recovery codes to copy or print, for when your phone is lost. Regenerate them at any time.
Trusted devices
Mark a device as trusted for 30 days so you are not asked on every sign-in.
Required for everyone
A company rule makes two-step verification compulsory for every user in the business.
Why it matters for a POS
Your back office holds your sales, customer details, supplier balances and settings. A stolen password, from a phishing email or a reused password leaked elsewhere, would give someone all of it. Two-step verification means a password on its own is not enough to get in. It is one of the simplest ways to protect the business.
It protects the app too. The same sign-in is used for the SeroPOS app and the back office, so the second step applies wherever the account is used. Staff signing in on a till and owners signing in from home are protected in the same way, so no device becomes the weak point.
Setting it up
In the back office, open your user menu and go to Security. Choose a method. For an authenticator app, scan the QR code with the app on your phone and enter the code it shows to confirm. For text messages, confirm your mobile number. For a passkey, follow your device's prompt.
Then save your recovery codes. You get ten; copy them somewhere safe or print them. Each one can be used once if you lose access to your phone. Regenerate a new set at any time, which cancels the old ones. Keep the codes somewhere you can reach without your phone.
- User menu, then Security
- Choose authenticator app, text message or passkey
- Confirm with a code or your device
- Copy or print your recovery codes
Signing in day to day
After your password, SeroPOS asks for the second step: the authenticator code, the text-message code or your passkey. On a device you use every day, tick the option to trust it for 30 days and you will not be asked again on that device until the time is up. Most staff barely notice it.
When your account is signed in on a new device, you receive an email about it. If it was not you, the Not me link in that email helps you secure the account. The Where you are signed in list in Security shows every device, with sign out for one device or everywhere else.
Requiring it for the whole team
An administrator can turn on the company rule Require two-step verification for everyone. Every user is then asked to set up a second step before they can carry on. That protects the business from the weakest password on the team, not only from the owner's. It takes each person a few minutes to set up.
Shared till devices are worth thinking about. Trusting a device for 30 days keeps sign-in quick at the counter, while anyone signing in somewhere new still needs the second step. Review the signed-in devices list from time to time and sign out any you no longer recognise. It takes a minute.
Frequently asked questions
What methods of two-step verification are there?
An authenticator app, a code by text message, or a passkey on your device. You also get ten recovery codes to use if you cannot reach your phone. Set them up in the back office under your user menu, then Security.
What if I lose my phone?
Use one of your recovery codes to sign in. Each code works once. Then go to Security, set up your second step on your new phone and regenerate your recovery codes so the old set stops working. Keep the new codes somewhere safe and separate from your phone.
Do I have to enter a code every time?
No. Trust a device you use regularly and you will not be asked for 30 days on that device. Signing in on a new device still asks for the second step. That keeps sign-in quick at the counter without giving up protection.
Can I make two-step verification compulsory?
Yes. An administrator can turn on Require two-step verification for everyone in Security. Every user then has to set up a second step to keep signing in. Give staff notice before you turn it on, so nobody is locked out at the start of a shift.
Can I sign out a device I no longer use?
Yes. Security has a Where you are signed in list. Sign out a single device, or sign out everywhere else, for example after a phone is lost or a staff member leaves. It takes effect straight away on the signed-out device.