Two-factor authentication (2FA) adds an extra layer of security to your AXP account for both your users of AXP to view guest credit card details and for guests themselves; in the case of a guest they are sent an OTP to download a Digital Key, or to select and use a previous card/address in the check in process.

If you or a guest afre having trouble with 2FA, this article covers common issues including incorrect codes, time sync problems, lost devices, and how to use recovery codes.

If the verification codes from your authenticator app aren't being accepted, the most common cause is a time sync issue.

1. Open your phone’s Settings app (not the Google Authenticator app)

2. Make sure your phone’s date and time are set automatically.

On Android:
​

(i) Settings → System → Date & Time
​

(ii) Enable:

On iPhone:
​

(i) Settings → General → Date & Time
​

(ii) Enable:

3. Close and reopen the Google Authenticator app

4. Wait for a new 6-digit code to appear, then enter it immediately before it refreshes (codes change every 30 seconds)

If you've lost your device or switched to a new phone, use a recovery code to regain access.

1. On the 2FA verification screen, click Use a recovery code

2. Enter one of your saved recovery codes

3. Once logged in, go to your security settings to set up 2FA on your new device

If you don't have recovery codes, contact your Brand Admin.

1. Ask your Brand Admin to reset your 2FA settings

2. Log in with just your password

3. Set up 2FA again with your current device

4. Save the new recovery codes in a secure location

A: Store your recovery codes in a secure location separate from your authenticator device. Options include a password manager, a printed copy in a secure location, or an encrypted file on a separate device.

A: The available 2FA methods depend on your Brand's security configuration. Contact your Brand Administrator to check which 2FA methods are enabled for your organisation.

A: When you set up 2FA, you receive a set of one-time recovery codes. Each code can only be used once. When you're running low on unused codes, generate a new set from your security settings.