> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mention-me.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Two-Factor Authentication (2FA)

> How 2FA works on the Mention Me platform, including setup, recovery, and reset procedures.

## What is 2FA?

2FA is an additional security measure beyond email and password that requires users to provide an authentication code via an authenticator app (e.g. Google Authenticator) to log in. This protects your employees from having their passwords phished.

2FA is automatically turned on for all Mention Me clients during onboarding.

## How 2FA works

2FA applies to all of your Mention Me admin users. Each user is asked to set up 2FA when they next log in.

The enrolment steps are:

<Steps>
  <Step title="Provide a mobile number">
    The user provides a mobile number to receive a recovery code if they cannot access their authenticator app.
  </Step>

  <Step title="Verify the mobile number">
    A verification code is sent to this number, which they enter.
  </Step>

  <Step title="Set up the authenticator app">
    The user downloads the Google Authenticator App (or another suitable app), scans the QR code, and enters the first test code.
  </Step>

  <Step title="Trust the device (optional)">
    If they tick "Trust this device for 30 days", they will not need to enter another 2FA code for 30 days on that device.
  </Step>

  <Step title="Complete setup">
    After setup, they can use the platform as normal.
  </Step>
</Steps>

## Recovery options

If a user cannot enter a 2FA code when logging in:

<Steps>
  <Step title="Request a recovery code">
    Click **Recovery options** and choose to receive a recovery code via SMS.
  </Step>

  <Step title="Enter the recovery code">
    If they can receive the SMS, they enter the code and reset their 2FA, following the same setup process.
  </Step>

  <Step title="Contact your administrator">
    If they cannot receive SMS, they can contact their administrator (any client administrator), who can trigger a 2FA reset via the **Manage users** page. The administrator should verify the identity of the requester (typically via a phone call or video call) before triggering the reset.
  </Step>

  <Step title="Escalate to Mention Me">
    If they cannot reach their administrator, they can escalate to [Mention Me's operations team](https://help.mention-me.com/hc/en-gb/requests/new?ticket_form_id=1900000712373), who can verify their identity and perform a reset.
  </Step>
</Steps>