Password and two-factor authentication

Both live in the Security card on the Settings page:

Manage sign-in protection and account access.

There are three rows: Password, Multi-factor authentication, and Active sessions.

---

Change your password

1. Open Settings from the account menu.
2. In the Security card, select Change password.
3. Fill in Current password, New password, and Confirm new password.
4. Save.

Your new password must meet the same rules as at sign-up:

• 12 or more characters
• Uppercase and lowercase letters
• At least one number and symbol

A confirmation appears: Password updated — Your password has been changed. Other devices were signed out.

Important. Changing your password signs out every other device. This is intentional — if you are changing it because you suspect someone else has access, that access ends immediately.

Messages you may see

Message	What it means
Enter your current and new password.	A field is empty
New passwords do not match.	The two new-password fields differ
Your new password must be different from your current password.	Reusing the same password
A message about your current password	The current password was wrong

Choosing a good password

Length beats complexity. Four or five unrelated words are stronger than a short string of symbol substitutions, and far easier to remember.

• Never reuse it. Password reuse is how most account takeovers actually happen — a breach somewhere else becomes a break-in here.
• Use a password manager if you can. It removes the reuse temptation entirely.
• Never share it. Fuzopay will never ask for your password or recovery codes by email, phone, or chat.

Forgotten your password?

You cannot change it from Settings without the current one. Sign out, select Forgot password? on the sign-in screen, and use the emailed reset link. See Sign in to Fuzopay.

---

Two-factor authentication

Two-factor authentication (2FA) adds a six-digit code from an app on your phone to every sign-in. The sign-in screen sums up why:

Two-step verification blocks most account takeovers, even if a password is exposed.

Important. 2FA is required before you can withdraw. Being identity-verified is not enough on its own. Turning it on now avoids being stopped mid-withdrawal later.

The Settings row is labelled Multi-factor authentication and reads Enabled or Disabled, with a toggle.

Turn it on

You need an authenticator app on your phone — Google Authenticator, Microsoft Authenticator, Authy, 1Password, or any other TOTP app.

Step 1 — Confirm your password

Switch the toggle on. The dialog is headed Set up two-factor authentication:

For your security, confirm your password to begin setup.

Enter your account password and select Continue.

Step 2 — Scan and verify

A QR code appears. Open your authenticator app, add a new account, and scan it.

If you cannot scan — you are on the same device as the app, or the camera will not focus — use the CAN'T SCAN? section and Enter this key manually. Type the key into your app instead.

Your app now shows a six-digit code that changes every 30 seconds. Enter the current one and select Verify & enable.

Step 3 — Save your recovery codes

This is the step people skip and regret.

You are shown a list of single-use recovery codes. Each one signs you in once if your authenticator is unavailable. Tick I saved these recovery codes securely. to finish.

Warning. If you lose both your authenticator app and your recovery codes, nobody can restore access from the sign-in screen. Recovery goes through support and requires identity verification.

Where to keep them

• ✅ In a password manager, as a secure note
• ✅ Printed and stored where you keep important documents
• ❌ A screenshot in your phone's photo library
• ❌ A note on the same phone as the authenticator app
• ❌ Email to yourself, or a cloud document shared with anyone

The point is that they survive the loss of your phone. Anything stored only on that phone defeats the purpose.

Signing in with 2FA on

After your email and password you reach Verify it's you and enter the six digits. The code is checked as soon as the sixth digit is typed.

If you cannot use your app, select Use a recovery code and enter one of your saved codes. Cross it off — it will not work a second time.

See Sign in to Fuzopay.

Turn it off

Switch the toggle off. The dialog is headed Disable two-factor authentication and asks for:

• Password
• Authenticator or recovery code — a 6-digit code or a recovery code

Both are required, because disabling 2FA is exactly what an attacker with only your password would want to do.

Important. With 2FA off you cannot withdraw. If you are turning it off to move to a new phone, turn it straight back on with the new device — do not leave it off.

Messages you may see: Enter your password and a current code. means one of the two fields is empty.

You receive a security notification when 2FA is disabled. Security alerts cannot be turned off.

---

Moving to a new phone

Plan this before you wipe the old device.

1. While you still have the old phone, turn 2FA off in Settings (password plus a current code).
2. Set up the new phone.
3. Turn 2FA back on and scan the new QR code.
4. Save the new recovery codes. The old ones no longer work.

If the old phone is already gone, use a recovery code to sign in, then repeat from step 1. If you have neither, contact support@fuzopay.com.

---

A five-minute security check

• Password is unique to Fuzopay
• 2FA is Enabled
• Recovery codes are saved somewhere that survives losing your phone
• Active sessions shows only devices you recognise
• Security notifications reach an inbox you actually read

---

Related articles

• Manage active sessions and signed-in devices
• Withdraw crypto from your Vault
• Sign in to Fuzopay
• Notification preferences