Two factor authentication for bookkeepers means every login that reaches client money or records asks for a second proof after the password, such as a code from an authenticator app or a tap on a security key. Turn it on for email first, then accounting software, cloud storage and any client bank access you hold.
Which bookkeeping accounts need two factor authentication first?
Your email account needs two factor authentication before anything else, because whoever controls the inbox can reset almost every other password you own. After email, protect the accounts that hold the most client data or can move money: accounting software, the cloud drive, your password manager and any bank portal where you have your own user.
A useful way to rank the rest is to ask two things of each login. Can it send or approve a payment? Can it open many clients at once? A firm-wide accounting login answers yes to the second question and sits near the top. A single client's payroll portal may answer yes to the first. A software trial you signed up for last spring answers no to both, and can wait or be closed.
The federal cybersecurity agency makes the same call. Its CISA "More than a Password" guidance lists email accounts first among the places to add a second factor, ahead of financial services.
Authenticator app, text code or security key for bookkeeping logins?
For most bookkeeping logins, an authenticator app is the practical default and a hardware security key is the stronger choice where a service supports it. Text message codes are better than nothing, but they can be intercepted or redirected, and they tie the account to one phone number that a single person controls.
The table below compares the three for a small practice.
| Second factor | Protection | Works when the phone is lost? | Best use |
|---|---|---|---|
| Security key (FIDO) | Resists fake login pages | Yes, if a spare key is registered | Email, password manager, admin accounts |
| Authenticator app | Good, but a code can be typed into a fake page | Only with backup codes or a synced app | Accounting software, cloud drive, tools |
| Text message code | Weakest of the three | No, unless the number moves to a new phone | Accounts that offer nothing else |
The point about fake pages matters for this work. A convincing email that copies a bank or a software vendor is the most common way bookkeepers lose a login. The CISA page describes FIDO-based sign-in as the only widely available phishing-resistant option, because the key will not answer a site whose address does not match. For the scams themselves, see the guide to phishing scams aimed at bookkeepers.
Client bank logins that allow only one two factor phone
Some client banks send the second-factor code to one phone number only, usually the owner's. When that happens, do not ask the client to change the number to yours. Ask the bank whether the client can add you as a separate user with your own login and your own phone, an option many business accounts offer.
Sharing a client's own login, with codes relayed by text at the moment you sign in, creates three problems. The bank cannot tell your actions from the client's. You depend on the client answering a message at the moment you need to work. And if the relationship ends, the client must change a password they may also use elsewhere. The post on how a bookkeeper should get access to client bank accounts covers the user and role options banks offer.
Often the simplest answer is that you do not need the bank login at all. If your work runs from statements, the client can forward the monthly PDF, and a tool such as AutoBankConvert converts it without anyone signing in to the bank. Whatever arrives that way still needs a home, and the post on how long to keep client bank statements sets the retention side.
Lost phones and missing two factor backup codes
The most common two factor mistake is turning it on and never saving the backup codes. When the phone is lost, broken or replaced, the account locks you out. Provider support can take days to restore it. Save backup codes the day you enable each account, in your password manager, not in a note on the same phone.
A few habits prevent the lockout:
- Register two factors where a service allows it, such as an app and a spare key kept in the office.
- Before trading in a phone, move the authenticator accounts to the new one and test a sign-in on each.
- For firm-wide accounts, make sure a second trusted person can recover access, so one absence does not stop the practice.
A two factor rollout order for a small bookkeeping practice
A two factor rollout works best in a fixed order, from the account that can reset everything down to the tools that hold little. Most small practices can finish it in an afternoon. Work through the list below and tick off each account only after a test sign-in from a second device succeeds.
- Email, for every person in the practice, with a security key if your provider supports one.
- Password manager, because it holds every other credential.
- Accounting software, including any accountant or partner console that opens many clients.
- Cloud storage where client statements and workpapers live.
- Bank users set up for you in clients' business banking.
- Payroll, tax and payment portals that can move money.
- Statement and reporting tools, including conversion software.
- Everything else, closing accounts you no longer use instead of securing them.
Record each account, the factor used and where its backup codes are stored. That list doubles as your offboarding sheet when someone leaves.
New clients add accounts to this list, and catch-up engagements add the most, because months of missing statements often mean new portal logins on day one. If you price that work, the guide to catch-up bookkeeping pricing is a good place to account for setup time like this.