ImmiAccount multi-factor authentication (MFA): setup and fixes

What is multi-factor authentication?

It means you need two things to log in: your password and a code. The code comes from an app on your phone or computer, so someone who only knows your password can't get in.

Multi-factor authentication is compulsory for ImmiAccount.

Which authenticator app should I use?

Home Affairs says there are several reputable and free authenticator apps, including Google Authenticator, Microsoft Authenticator and Duo Mobile. It also says the department does not have its own authenticator app, so be careful with apps that claim to be official.

How do I set up MFA with an app?

1. Install an authenticator app from your phone's app store.
2. Log in to ImmiAccount and follow the on-screen instructions.
3. In the app, add a new account. This is usually a "+" icon or an "Add account" button.
4. Scan the QR code on your screen. If you can't scan it, enter the shared secret key by hand.
5. Type the code the app shows into ImmiAccount to confirm.
6. Log out and log in again to test it.

The app shows a 6-digit time-based code that changes every 30 seconds. Use a fresh code every time.

Can I set up MFA on a computer?

Yes. Home Affairs lists KeePass, a free download from keepass.info, as an option for a PC. It has its own setup guide on the Home Affairs site.

Can I get codes by email instead?

Home Affairs offers an email option. A 6-digit code is sent to the verified email address on your ImmiAccount, and it is valid for 15 minutes. The department warns that email codes are less secure than an app and says to choose this option "only if absolutely necessary". Delivery can also be affected by your email routing or by your organisation's security settings.

My code doesn't work. What should I check?

• Is it the current code? Codes change every 30 seconds. Wait for the next one.
• Is your phone's time right? Set date and time to automatic.
• Are you using the right account entry? If you have several entries in your app, pick the one for ImmiAccount.
• Did you change your phone? Codes do not move to a new phone by themselves. Use the recovery link below.

I lost my phone or the app. How do I get back in?

1. On the login page, select I no longer have access to my multi-factor authentication app.
2. Enter your password and answer your secret questions.
3. Set up MFA again with a new authenticator.

If you're part of an organisation, ask your Organisation Account Administrator to reset your MFA first.

How can I change my MFA later?

After you log in, Home Affairs says you can change your multi-factor authentication in your account settings.