Two-factor authentication and your recovery codes

Two-factor authentication means signing in takes your password and a six-digit code from an app on your phone. Someone who learns your password still cannot get in.

It is optional for the account as a whole, and required before you connect a bank. A bank connection brings your transactions and balances into HQ, and a password on its own is not enough to stand in front of that.

Turn it on

1. Go to Settings › My Account, section Two-Factor Authentication.
2. Click Enable Two-Factor Authentication.
3. Scan the QR code with an authenticator app on your phone: Google Authenticator, Authy, 1Password and Microsoft Authenticator all work. If the camera will not cooperate, open Can't scan? Enter manually and type the key in by hand.
4. Enter the six digits the app is showing under Verification code and click Verify & Enable.
5. HQ shows your recovery codes. Save them before you carry on, as described below.

Turning it on signs you out everywhere else, so any other browser or device signs in again with a code. The QR code is drawn in your own browser; the key behind it never leaves HQ.

Each six-digit code works once. If a sign-in is refused straight after another one, wait for the app to show the next code.

To move to a new phone or a different app, turn two-factor authentication off and set it up again. HQ will not replace the key while it is on.

Your recovery codes

You get eight of them, and they are the way back into your account if you lose the phone with your authenticator app on it. Each one works a single time.

They are shown once and never again. TALISK_HQ keeps only a scrambled copy, so this is not a case where support can read them out to you later: nobody here can see them. Use Copy to put them on the clipboard, or Download to save them as a file. Keeping them in a password manager is ideal. Keeping them only on the same phone as the authenticator app is not, because losing that phone then costs you both at once.

HQ will not let you leave the screen until you say you have saved them. That is deliberate, and it is the one time we get in your way on purpose.

Signing in once it is on

Enter your email and password as usual. HQ then asks for a Two-factor code: open your authenticator app and type the six digits it shows for HQ. The code changes every thirty seconds, so if it is about to roll over, wait for the next one.

If you have added a passkey, the same screen shows Use passkey above the code box. Tap it and confirm with Face ID, Touch ID or your device PIN; there is no code to find or type. The code box stays underneath for any device without your passkey.

After you sign in with a code, HQ may offer Skip the code next time. Choose Add a passkey to set one up on that device, or Not now to carry on; the offer then stays away from that device for a month. You can also add one any time in Settings › Account › Passkeys.

Passkeys work at taliskhq.com, and in the HQ desktop app for Mac from version 1.6.0. On talisk.ai, in the Windows app and in older Mac versions, sign in with your code. An HQ app on your phone's Home Screen that was added from talisk.ai stays on talisk.ai, and its Passkeys card says so; to use a passkey on that phone, open taliskhq.com in your browser and add HQ to your Home Screen from there.

The check on the sign-in screen

The sign-in and sign-up screens carry a small automatic check from Cloudflare that tells a person from a script trying passwords. Usually it passes on its own and you see nothing more than a tick. If it asks you to confirm, do so and then sign in.

If sign-in says Verification failed. Please try again., reload the page so the check runs again, then sign in. A browser extension that blocks third-party content can stop the check from loading; allow challenges.cloudflare.com, or try another browser. In the desktop app, an old version may ask you to update before the check can load.

If you lose your authenticator app

On the code screen, use Lost access to your authenticator? Use a recovery code. Enter one of your saved codes and you are in. That code is then spent, so once you are signed in, generate a fresh set.

If you have lost your recovery codes too

There is a way back, and it starts from the sign-in screen. Sign in with your email and password as usual, and on the code screen follow Lost access to your authenticator? Use a recovery code, then Don't have a recovery code? Verify your identity instead.

HQ shows the email address you signed in with, then shows you a number between one and five. Photograph two things: your government photo ID, and yourself holding up that many fingers. The number is what proves the selfie was taken just now, for this request, so take the photo after you see it rather than using one you already had.

Send them, and a person here checks the ID against your account. This is not instant, and it is not meant to be: it is the only step standing between a stranger and your books. You get an email when it is decided.

On a Partner account, which reaches every client's books, the photos are not enough on their own: we also confirm who you are directly, usually on a call, before your request is approved.

When it is approved, two-factor authentication is switched off on your account so you can sign straight in with just your email and password. Turn it back on and save the new recovery codes before you carry on.

TALISK_HQ keeps the two photos encrypted, uses them only to confirm who you are, and destroys them 90 days after the decision. The record that you asked and what was decided is kept.

If you have also lost access to the email inbox you sign in with, the code screen offers Move your account to a new address instead. See Lost access to the email you sign in with.

If the photos are hard to read, or the selfie does not show the number of fingers we asked for, the request is turned down and you can get in touch directly.

Get a new set of recovery codes

Go to Settings › My Account and click Generate new recovery codes. Confirm your password, and the new set appears. Save it the same way.

Do this whenever you have used one, whenever you are not certain your saved copy is still somewhere you can reach, or if you were never shown a set in the first place. Generating a new set replaces every unused code you had, so an old list you no longer trust stops working the moment you do it.

Your existing codes cannot be recovered or re-displayed, only replaced. That is the same property that makes them safe to store, so replacing them is the answer whenever there is any doubt.

Turn it off

Settings › My Account, then Turn off 2FA. HQ first says what changes, and you press Turn off two-factor; then you confirm your password. Signing in then asks for your password only, and the HQ code in your authenticator app stops working, so turning it back on means setting it up from the start.

Turning it off deletes your recovery codes along with it, which is what you want: they are no use without the app they back up, and leaving them alive would be a surprise the next time you switch two-factor authentication on. You get a completely new set when you do.

Bear in mind that you cannot connect a bank while it is off. Existing bank connections carry on working normally.

If you use a passkey

A passkey only ever stands in for your two-factor code when you sign in. Add one on the web in Settings › Account › Passkeys with Add a passkey, or on your phone under More, Security, with Add this phone. On the web you can name it first; left blank, it is named for the kind of computer and the date, such as "Mac · 3 Nov 2026". Each one is listed with its name, when it was added and when it was last used, and Remove beside it takes it away; your authenticator code keeps working either way.

When a passkey is added we email you its name and when it was added. If it wasn't you, remove it in Settings › Account › Passkeys on the web, or More, Security on the phone, and change your password.

On the phone, the passkey that lives on that phone is listed as This phone, and Add this phone is not offered once it holds one. The Security row on More says the same, so you can tell before you tap.

A passkey saved to iCloud Keychain or Google Password Manager reaches your other devices by itself. A device that already has one for your account says so when you try to add another, and you can sign in with it as it is.

HQ will not let you turn two-step verification off while you have a passkey enrolled, and it says so when you try. A passkey takes the place of the two-step code, so without two-step verification it would never be asked for. Remove the passkey first, in Settings › Account › Passkeys.