Turn on two-step verification (2FA)

With two-step verification (2FA), you enter a 6-digit code from an app on your phone in addition to your password when you log in. Even if someone knows your password, they cannot get into the account without your phone. On a marketplace where you share accounts, negotiate large sums and receive bank details in a deal, it is the single most important protection you can turn on. 2FA is optional on Sitavo, but we recommend it for anyone with listings, offers or deals.

What you need

• An authenticator app on your phone, such as Google Authenticator, Microsoft Authenticator, 1Password or Bitwarden. The app generates a new code every 30 seconds — even without internet.
• A safe place for your backup codes, such as a password manager or a piece of paper that is not kept with your phone.
• A couple of minutes at a computer or another screen so you can scan the QR code with your phone.

How to turn on 2FA

1. Install an authenticator app on your phone.
2. Go to Account and login and choose Set up next to «Authenticator app».
3. Scan the QR code with the app. If you cannot scan, you can enter the key manually.
4. Enter the 6-digit code from the app to confirm.
5. Store your 8 backup codes somewhere safe — copy them or download them as a file. They are shown only this once.

From then on, we ask for the code from the app every time you log in on a new session — also when you sign in with Google. If your phone is not at hand, you can use a backup code instead. You get an email whenever 2FA is turned on or off.

Backup codes

• Each backup code (format XXXX-XXXX) can be used once.
• Under Account and login you can see how many of the 8 codes you have left. For security, we only store an encrypted version, so the codes cannot be shown again.
• If you have lost them or used most of them, choose Generate new backup codes. The old ones then stop working.
• Keep the codes somewhere other than your phone — if you lose the phone, the codes still need to be available.

New phone

If you change phones, choose Manage → Move to a new phone while you still have the old one. You confirm with a code from the current app or a backup code and then scan a new QR code with the new phone. The old one stops working. Many authenticator apps can also back up your codes — but move 2FA through Sitavo anyway, so you know the new phone works.

Lost your phone?

1. Log in with your password and one of your backup codes.
2. Move 2FA to the new phone under Account and login, and generate new backup codes.
3. Log out other devices under Active sessions if the phone may be in someone else’s hands.
4. If you have neither phone nor backup codes, create a case under Help and cases and choose «My account» → «I can’t log in». We will ask you to confirm who you are before we help — it takes longer, so always keep your backup codes.

Wrong codes and alerts

If wrong codes are entered several times after a correct login, we slow down the attempts, and after five wrong codes within an hour you get a security email. It means someone has known your password. Change it immediately — see password and sessions.

Turn off 2FA

You can turn off 2FA under Manage. Then anyone with your password can log in, and your backup codes are deleted. We recommend keeping it on, especially if you have listings or ongoing deals.