Two-factor protection

With two-factor protection, one password isn't enough to sign in to Invoicebox ID. On top of your password or SMS code, signing in asks for a second confirmation. Even if someone learns your password or intercepts a single code, they can't get in without the second factor.

Ways to confirm

You can confirm the second factor in different ways — pick the one that suits you, or better, set up several so you have a spare:

• A code by SMS or email. The basic method. Signed in by phone — the code goes to your email; signed in by email — the code comes to your phone. It works as soon as protection is on.
• A passkey. Your device's fingerprint, face or PIN instead of a code. Set it up in the Passkeys section.
• An authenticator app. A one-time code from Google Authenticator, 1Password, Aegis and similar apps. The code changes every half a minute and works without internet.
• Backup codes. One-time codes for when the other methods are unavailable — more on them below.

All four methods, with their states, are gathered in the «Confirmation methods» block on the two-factor authentication screen.

How to turn it on

In the account this setting is called «Two-factor authentication». Turning it on and off requires confirmation — with a code or a passkey — so you can't flip the setting by accident.

To turn it on you need both confirmed channels — phone and email. The second code goes to the channel you didn't just sign in with, so the protection can't work without a second channel.

1. Open the «Security» section and click «Turn on» in the «Two-factor authentication» card.
2. On the screen that opens, click «Turn on» (later, the «Turn off» button lives here too).
3. Confirm the operation.

If you don't have a second channel yet, you'll first be asked to add and confirm one. This isn't a wasted step: without a backup channel you risk locking yourself out — losing access to the only place a code arrives.

Once it's on, the two-factor protection screen shows every confirmation method. From here you can also connect an authenticator app or add a passkey.

You get an email each time two-factor protection is turned on or off. If an email arrives and you changed nothing, change your password right away and check your active sign-ins and devices.

Authenticator app

An authenticator app produces one-time codes right on your phone — no SMS, no network. That helps when you're travelling or where the signal is weak, and the code can't be intercepted on the way, the way an SMS can.

How to connect it:

1. Open «Security» → «Two-factor authentication» → the «Authenticator app» row, and click «Set up».
2. Scan the QR code with your app. Can't line up the camera — enter the «Key for manual entry».
3. Enter the code from the app and click «Confirm». That confirms it's linked to your profile.

Done: when signing in, you can enter the code from the app instead of a code to your email or SMS.

Backup codes

Backup codes are one-time codes for when your phone isn't available. They're created on the two-factor authentication screen: in the «Backup codes» row, click «Create codes». In the window that shows them, you can «Copy» the codes or «Download» them as a file.

• Save them right away. The codes are shown once. Write them down or put them in a password manager.
• Each code works once. Enter it at sign-in and it's spent. The remainder is shown in the same row.
• Running out of codes, or not sure they're safe — click «Reissue». The old ones stop working straight away.

If you lose access to a confirmation method

Changed your number, lost access to your email, replaced your phone along with the app — here's how to get back in:

• Enter a backup code instead of the usual confirmation code — each works once.
• Sign in with a passkey, if you set one up. The key confirms the sign-in on its own.
• Contact support. An operator will reset two-factor protection after verifying the profile is yours. A reset removes every method — the authenticator app and the backup codes alike — and you'll need to set them up again.

Support: c-support@invoicebox.ru, +7 (812) 448-08-01 (9:00–21:00 Moscow time).

Signing in from a new device

The first sign-in from an unfamiliar device is a separate story. It may ask for a second code even if two-factor protection is off. It's a one-time check: Invoicebox makes sure it's you behind the new device, not someone who picked up your password.

After that this device won't ask for a code. If you tick «Trust this device», it's remembered as yours and there's no repeat check.

What's next

• Connect an authenticator app and save your backup codes — signing in won't depend on SMS.
• Set up a passkey — another backup way to sign in.
• Check your sign-ins and devices and end the ones you don't recognize.