How to protect your profile
In fifteen minutes you can close your profile off from anyone else: confirm your email, turn on the second factor, set up a passkey, and check who's signing in and from which devices. Below is the order by importance. Start at the top and work down; the first three items give you the most protection.
Where to start
- Confirm your email. It's your second channel for codes and for recovering access. Until your email is confirmed, getting your profile back after a lost password is harder. You can do this in your profile.
- Turn on two-factor protection. At sign-in the system asks for a second code on top of your password — so even if your password is stolen, no one can sign in without your phone. Set it up in the two-factor protection section.
- Set up a passkey. Sign in with your fingerprint, face or PIN — no password at all, and a backup factor in case you lose your phone. See how to add one on the passkeys page.
What to check from time to time
- Review «Sessions». Here you can see which devices are signed in. Spot one you don't recognize — end it in the sessions section.
- Revoke app access. If you no longer trust an app, or can't remember why you granted access, remove it in the app access section.
- Check your linked services. Sign-in through banks and Yandex is a way in too: extra links are worth unlinking.
- Keep an eye on the activity history. The history shows where your profile was signed in from. Leave security notifications on — that way you learn about a new sign-in right away.
- Set up auto sign-out and the session limit. On the «Security» screen you can shorten the idle time before automatic sign-out and cap the number of simultaneous sessions — more in the Sessions and devices article.
Warning
Don't tick «Trust this device» on someone else's or a shared computer. Otherwise it remembers you and won't ask for the second code next time — and anyone can get to it.
If you think your profile has been compromised
Act in order, without delay.
- Change your password. This ends all other sessions. Whoever signed in with your password is kicked out.
- End the other sessions. In the sessions section, click «End all others» — this closes sign-ins everywhere except the current device.
- Lost your second factor? If your phone or key is unavailable and you can't sign in, contact support — an operator will reset two-factor protection after verifying it's you.
Support: c-support@invoicebox.ru, +7 (812) 448-08-01 (9:00–21:00 Moscow time).
Next
Work through the items top to bottom — start with confirming your email and two-factor protection. For a general overview of your profile and its settings, see the overview section.