Turn on two-factor sign-in and keep your recovery codes
Add a second step with an authenticator app or Telegram codes, and save the ten recovery codes Finmind shows once.
What it does
After your password, or after Google or Telegram sign-in, Finmind asks for a one-time code. Someone who learns your password still cannot sign in without the code. You find it all in Settings, under Two-factor authentication.
Choose a method
- Authenticator app. You can add up to five.
- Telegram codes. Finmind sends the code to your linked Telegram chat. Link Telegram first: see Link the Telegram bot to your Finmind account.
- Backups. Codes by SMS as a backup for the app (needs a verified phone number), a backup email address, and the recovery codes below.
Passkeys sign you in and confirm changes too; they are listed under Passkeys in Settings.
Turn it on with an authenticator app
- Step 1: Open Settings.Find Two-factor authentication.
- Step 2: Choose Set up the app.Scan the QR code with your authenticator app, or type the key it shows.
- Step 3: Confirm.Type the code the app shows and choose Confirm and turn on.
Turn it on with Telegram codes
- Step 1: Link Telegram.Under Telegram notifications and payments, choose Connect Telegram.
- Step 2: Choose Use Telegram codes.Then choose Send a test code.
- Step 3: Confirm.Type the test code and choose Confirm and turn on.
Two-factor sign-in turns on only after the code you typed is right, so a channel that never worked cannot lock you out.
Recovery codes
When you turn two-factor sign-in on, Finmind creates 10 recovery codes of 10 characters each. They are shown only then. Save them in a password manager or print them. Each code works once, and capital letters, spaces and hyphens do not matter. Create new recovery codes replaces all of them at once; the old ones stop working.
If you lose your phone, choose Use a recovery code on the sign-in page. SMS codes or the backup email address are offered there too, when you set them up.
When Finmind asks for a code again
Some actions ask for your current code even when you are signed in: turning on live trading, connecting a brokerage account or changing its login, changing two-factor sign-in, your password, email address or passkeys, exporting your data and asking for deletion. Placing an order does not.
Source: Settings, Two-factor authentication, read on 8 November 2026.