Setting up two-step verification (MFA)
Two-step verification adds a second check when you sign in, so a password alone cannot open your account. Your agency may require it. When it does, the first sign-in after the rule starts shows “Multi-factor authentication is required” and you set it up before anything else. If your agency gives a grace period you see “Remind me later” instead, for a limited number of sign-ins.
Pick a method You see only the methods your agency allows: Authenticator app (recommended), Text message (SMS), or Email code. Press Enable beside the one you want. You are first asked to confirm your password on the “Confirm it’s you” screen.
Text message (SMS) Enter your mobile number with the country code, for example +1 416 555 0199 (Canadian and US numbers only), and press Send code. Type the 6-digit code from the text and press Verify. Use Change number if you typed it wrong.
Authenticator app Install Google Authenticator, Microsoft Authenticator, Authy or 1Password on your phone first. On a computer: open the app, choose Add account › Scan a QR code and scan the code CubbyPro shows. On the same phone as the app: you cannot scan your own screen, so press Copy key, then in the app choose Add account › Enter a setup key, name it CubbyPro and paste the key. Either way, type the 6-digit code the app shows and press Verify & enable.
Email code Press Enable MFA. The next screen shows 8 recovery codes. Press Copy all to clipboard, save them somewhere safe (not in your email), then press I’ve saved them — continue. Each code works once if you ever cannot get to your email.
“Your email address must be verified” Text message and authenticator setup need a verified email address. Press Send verification email, open the link in your inbox, come back to CubbyPro and press Send code (or Verify) again. If no email arrives, check spam, then ask your agency office to mark your email verified.
Signing in afterwards On a device you have used before, nothing changes. On a new device, or after 30 days away, sign in with your password, then enter the 6-digit code (texted, from your app, or emailed). The device is then trusted for 30 days.
Trusted devices The MFA & Devices tab lists every device that has signed in. Press Revoke beside one you do not recognise, or Sign out everywhere to clear them all. Each will need the second step again.
“New sign-in” emails CubbyPro emails you when your account signs in on a phone or browser it has not seen before. Opening the app again on the same phone does not send another. If you get one and it was not you, change your password and tell your agency office.
New phone or lost phone Email code: sign in with a recovery code, then set up again on the new phone. Text message or authenticator: if you still have the old phone, add the new method first and then revoke the old one. If the old phone is gone, ask your agency office; they contact CubbyPro support to reset the second step so you can enrol again.