MFA and account security

Anything that reaches HMRC on your behalf is protected by a second factor, as HMRC expects of Making Tax Digital software. VATflow uses a time-based one-time code from an authenticator app (see Getting started for set-up). Your password alone is never enough to file.

• Once per sign-in the first time you open anything that reads from HMRC, such as your VAT periods or payments. The dialog says Confirm with your authenticator. After that, reads in the same sign-in do not ask again.
• A fresh code, if your last one is more than 15 minutes old, for the actions that change something: submitting a return, connecting or disconnecting HMRC, and removing an authenticator.
• Signing in itself needs only your password; the code comes when you act.

1. On the sign-in page choose Use a recovery code.
2. Enter your email address and one of the recovery codes you saved when you set up the authenticator.
3. VATflow signs you in and removes the old authenticator from your account, so a found or stolen phone can no longer be used. The code you used is spent.
4. Go to Settings and set up your new authenticator app straight away, then save the new recovery codes.

• Each code works once. Keep them somewhere other than your phone, such as a password manager.
• Regenerate recovery codes in Settings at any time. The previous set stops working immediately.
• If you have used them all and lose your phone, email support@vatflow.uk from your account email address.

In Settings you can add email codes: a 6-digit code sent to your account address when you sign in. It is a backup for the authenticator, not a replacement. Actions that reach HMRC still need the authenticator app, because HMRC’s rules for multi-factor evidence are met by the app and not by email.

VATflow slows down and then stops repeated failed attempts, per account:

• Password sign-in: after 3 failed attempts in 15 minutes a security check appears; after 5 the account is locked for the rest of that 15-minute window. Wait, then try again with the correct password.
• Recovery-code sign-in: 10 attempts in an hour. After that the account cools off for 15 minutes from the last failure, then you get a fresh set of attempts.

The message is the same whether the email, the password or the code was wrong, so a lockout never confirms to anyone which part they got right.

• Change your password in Settings. You must enter your current password as well as the new one, and the new one cannot be a password seen in a known breach.
• Changing your password signs out every other device; the one you are using stays signed in.
• Sign out other devices from Settings at any time, for example after using a shared computer.
• Security activity in Settings lists recent sign-ins, password changes and authenticator changes on your account.