Multi-factor authentication for Online Services

From Monday 8 September 2025, multi-factor authentication (MFA) will be mandatory for all users of our online services.

We’ve introduced this extra layer of security to help protect your intellectual property and personal data.

Important information

• MFA setup will only be available from 8 September 2025. You won’t be able to register or switch to MFA before this date.
• You will be prompted to register the first time you log in on or after 8 September.
• Our B2B customers using application programming interfaces (APIs) are not affected by MFA and can continue to access services as usual.
• If your business shares one user account across multiple users, switch to a corporate account so each user can authenticate successfully. To set up a corporate account call our Contact Centre on 1300 651 010.

How to prepare for MFA

• Choose which method to use: an authentication app (such as Microsoft, Google or Apple), MyID or a FIDO2Key.
• Install your choice of authentication app or MyID on your mobile device.

How to register for MFA

From 8 September, new and existing users will need to use MFA to log into online services or when creating a new account.

Register with an authenticator app

1. Go to online services and enter your username and password.
2. Select ‘Google Authenticator or similar’.
3. Open your chosen authenticator app and select ‘Add account’ or the + sign.
4. Scan the QR code displayed.
5. Enter the one-time code generated by the app and click continue.
6. Save the single-use recovery code offline. This is your backup access method if your app or device is lost. If you lose your recovery code, call our Contact Centre on 1300 651 010.

Register with a security key

1. Go to online services and enter your username and password.
2. Select ‘Security Key’ if using a physical token.
3. Follow the instructions to register your security key.
4. Choose where to save the passkey.
5. Follow the prompts to complete security key set up and create a PIN.
6. When prompted, push the button or touch the sensor on the security key to complete registration. You should receive confirmation that the passkey has been saved.
7. Name your security key to help you identify it if you use multiple keys. You should receive confirmation the security key registration was successful.
8. Save the single-use recovery code offline. This is your backup access method if you lose access to your security key. If you lose your recovery code, call our Contact Centre on 1300 651 010.

How to log in using MFA

1. Enter your username and password on the login screen.
2. Enter the one-time code from your authenticator app, MyID or use your security key PIN to complete the login process.

To change your registered authentication method, you will need to request an MFA reset. To do this you can phone the Contact Centre on 1300 651 010 or submit a request by email.

Download our MFA user guide for detailed instructions on how to register and log in.

If you need assistance setting up or using MFA, please call the Contact Centre on 1300 651 010.

If you can't register for MFA on 8 September, a grace period will apply until 30 September. During this time, you can skip MFA setup once for 24 hours after your first login. After that, you must complete MFA registration to continue using online services.