Maintaining Security on Your Account

Your login is tied to your name, and anything filed from it is your dealership’s responsibility — which is why this page is worth ten minutes. It covers changing your password, the extra check you meet when you do, turning on two-factor authentication, and what the app does on its own to watch for someone who is not you.

Before you start

Everything here lives in Settings, under Your Account. You can change your own security settings whenever you like; you do not need an admin to do it for you.

If you cannot sign in at all, start with Resetting Your Password.

Change your password

Open Settings, then Change Password. Type the new password twice and click Save.

Choose a new password

At least 8 characters. You will stay signed in on this device.

Show passwords

New password

••••••••

Confirm password

••••••••

Save

IllustrationChoose a new password is one card: a note saying at least 8 characters and that you will stay signed in on this device, a single Show passwords control at the top right that reveals both fields at once, then New password and Confirm password, then Save. There is no field for your current password — see the note below about how it checks it is you.

Show passwords at the top right reveals both fields together, which is quicker than guessing where the two differ.

It will ask you to confirm it is you

There is no “current password” box on this screen. Instead, if it has been a while since you signed in, saving opens a small window headed “For your security, confirm it’s you before changing how you sign in.” Confirm with whatever is easiest — Use your passkey, Email me a code, Text me a code or Use my password — and the save goes through.

Once you have confirmed, you are not asked again for 15 minutes, so changing two things in a row only asks once. Signing in counts as confirming, which is why you often will not see this window at all.

After you change it, you get one question

Your password was changed tells you how many other devices are still signed in, and asks what to do about them:

• Sign out other devices if you do not recognise the count, or if somebody else may have got into your account.
• Keep them signed in if you were simply changing your password. Nothing is signed out.
• Review devices takes you to the list first, if you would rather look before deciding.

Changing your password does not sign other devices out on its own. That is a deliberate change: it asks, so a routine password change does not lock you out of the phone in your pocket.

What makes a good one

• A mix of upper and lower case, numbers and symbols.
• Not a name, a birthday, a plate number or 12345.
• Not the password you use anywhere else. Reused passwords are how one leak becomes several.

Tip

A passkey is better than a strong password, because there is nothing to type into a fake sign-in page and nothing to read out over the phone. It also skips the two-factor code. See Setting Up and Using Passkeys.

Turn on two-factor authentication

Two-factor means a six-digit code on top of your password. Open Settings, then Two-Factor Authentication, and turn on the method you want:

• Send code via email — the code goes to your account’s email address.
• Send code by phone — the code goes to a phone number you enter. Choose Text Message or WhatsApp under Delivery method. This one needs your business to be verified with us first; until it is, the switch will say so.

If you turn on both, a Preferred Two-Factor Method setting appears so you can say which one you would rather use at sign-in.

How should we send your code?

Turn on at least one. We ask for a code when you sign in from a device we do not recognise.

Send code via email

Your two-factor authentication codes will be sent by email

Send code by phone

Your two-factor authentication codes will be sent by text message or WhatsApp

IllustrationTwo-Factor Authentication asks one question — how should we send your code? — and offers email and phone as switches, each saying what it does. Email is drawn on because the app will not always let you turn it off: it has to stay as a fallback, and on a dealership filing registrations two-factor cannot be switched off at all.

Caution

If your account files registrations, two-factor is required — but nothing switches it on for you. Until you turn it on yourself, the Account Notice keeps listing it and registrations will not go through.

And once you have turned on the email code and confirmed it, you cannot turn it back off — that is true for everyone, not just people who file registrations. It stays as the fallback so losing a phone can never lock you out. You can still add or remove the phone code on top of it.

How often you will be asked

• After you enter a code, that device is remembered for 30 days. Signing out and back in on the same device will not ask again.
• Only one device is remembered at a time. Entering a code on a new device makes the previous one forgotten, so the computer at the office will ask again next time. That is expected.

Signing In covers what the code screen looks like and how to have the code re-sent.

What we do without being asked

We email you about sign-ins from somewhere new. The first time your account is used from an internet connection we have not seen before, you get an email with the date, the rough location and the kind of device. Your usual laptop on hotel Wi-Fi will trigger one; a new computer on your own office Wi-Fi may not. Read those. If one describes something you did not do, change your password immediately and contact support.

We record who did what. Every change is attributed to a named person in the activity log. That only works if people are not sharing logins.

Never share your password

Especially if your account can file registrations. Every request to the state is made under your personal information, and the state holds you responsible for what was filed. Sharing a login is prohibited here and by the rules we file under — it is the one habit that turns a small mistake into somebody else’s problem with your name on it.

Everyone who needs access should have their own login. See Adding or Removing Users, which also covers how many users your account includes and how to remove someone the day they leave.

Keep your contact details current

If your email address or phone number is out of date, so is every way we have of reaching you when something is wrong with your account — including the two-factor code itself. Check them in Your Personal Information.