Two-factor authentication (2FA) means that even if someone learns your password, they still cannot get into your account without a second code that only you can access. We strongly recommend every authorised user on your company's account turns it on.
Step 1 — Sign in and open security settings
- Sign in to the portal at clients.credicorp.co.uk/login with your email and password.
- Open Settings and select the Security or Sign-in methods tab.
- Choose Set up two-factor authentication.
Step 2 — Choose your second-factor method
We support three methods, listed from most secure to least:
Authenticator app (recommended)
An authenticator app on your phone (Google Authenticator, Microsoft Authenticator, Authy, or any TOTP-compatible app) generates a new 6-digit code every 30 seconds. No internet connection needed; the code is generated locally. This is the most common and most secure SMS-free option.
To set up: scan the QR code shown in your security settings with your authenticator app, then enter the 6-digit code it shows to confirm the link is working.
Hardware security key
A hardware key (such as a YubiKey) is the strongest option — you tap the physical key instead of typing any code. It cannot be phished. For a full guide, see using a hardware security key with Credicorp.
SMS code
A one-time code is sent to your registered mobile number. This is convenient but less secure than an app, because a phone number can be targeted by SIM-swap fraud. If you use SMS 2FA, enable an authenticator app or passkey as soon as possible and use SMS only as a fallback.
Step 3 — Save your recovery codes
After setting up 2FA, you will be given a set of one-time recovery codes. Save these now — they are the backup route if you ever lose your phone or authenticator. Good places to store them:
- A password manager (1Password, Bitwarden, iCloud Keychain)
- An encrypted note on a secure device
- A printed copy in a physically secure location (not kept with your phone)
Each code can only be used once. Once all codes are used, generate a new set from Settings → Security.
What to expect when you sign in with 2FA
- Enter your email and password as normal.
- You will be prompted for your second factor — either the current code from your authenticator app, a tap of your hardware key, or an SMS code.
- Enter the code and your sign-in completes. Codes from authenticator apps are time-sensitive (30-second window) — enter them promptly.
If you are locked out or lose your second factor
If you cannot access your authenticator app or hardware key, use one of your backup recovery codes on the sign-in screen (look for Use a recovery code or Other options). If you do not have recovery codes either, see recovering access after losing your two-factor authenticator — this covers identity-verified account recovery through our support team.
Good practice
- Use an authenticator app rather than SMS where possible — it is harder to intercept.
- Store recovery codes in your password manager before you need them.
- Register a passkey alongside 2FA as a convenient, phishing-resistant alternative sign-in route — see setting up a passkey.
- If more than one director or finance team member uses the account, each person should set up their own 2FA on their own individual login. 2FA is per-user, not per-company.
- Never share your 2FA code with anyone. Credicorp will never ask for it — see how Credicorp will and will not contact you.
See also: Recovering access after losing your two-factor authenticator, Using a hardware security key with Credicorp, Setting up a passkey for your Credicorp account.