Authenticator app 2FA for business accounts: a rollout guide

Authenticator app 2FA adds a second step to logging in: after entering a password, the user types a six-digit code generated by an app on their phone, such as Google Authenticator, Microsoft Authenticator or a password manager with a built-in authenticator. The code changes every 30 seconds and is generated on the device itself, so a stolen password alone isn't enough to get in. For business accounts that can move money, change bank details or export customer data, it's one of the most effective security controls you can switch on.

This guide explains how it works, how it compares with SMS codes, and how to roll it out without locking your team out.

Why business accounts need two-factor authentication

Payment dashboards, accounting systems and billing platforms hold exactly what attackers want: the ability to issue refunds, change payout bank accounts, download customer lists and create API keys. The most common way in is not a clever hack but a reused or phished password.

Two-factor authentication (2FA) means an attacker needs something you know (the password) and something you have (your phone with the authenticator app). That stops most credential-stuffing and many phishing attempts outright.

For South African businesses there's a compliance angle too. POPIA section 19 requires responsible parties to take appropriate, reasonable technical and organisational measures to secure personal information. Requiring 2FA on systems that hold customer data is a straightforward, documentable measure. See our guide to POPIA and payment data.

How authenticator app 2FA works

Most authenticator apps implement TOTP, the time-based one-time password algorithm defined in RFC 6238:

1. Enrolment. The service generates a random secret and shows it as a QR code. You scan it with your authenticator app, which stores the secret on your phone.
2. Code generation. Every 30 seconds (the standard time step), the app combines the secret with the current time using an HMAC and turns the result into a short numeric code, usually six digits.
3. Verification. The server does the same calculation with its copy of the secret and checks that your code matches, typically allowing a small window for clock drift.

Because both sides compute the code independently, nothing is sent to your phone at login. The app even works offline.

Authenticator app vs SMS codes

SMS codes are far better than no second factor, but SIM swap fraud, where a criminal persuades a network operator to move your number to a new SIM, is a well-known risk in South Africa. Authenticator apps sidestep it. Hardware security keys offer even stronger phishing resistance where a service supports them.

Backup codes: the part people forget

When a phone is lost, broken or replaced, the authenticator secret goes with it unless the app backs it up. Services therefore issue backup codes at enrolment: a short list of single-use codes that work in place of the app.

Good practice for your team:

• Save backup codes in a company password manager or print them and store them securely, not in an email or a screenshot on the same phone.
• Treat each code as single-use; generate a new set once most are used.
• Make sure at least two administrators can reset another user's 2FA, so one lost phone never locks the business out.

Rolling out 2FA to your team: a practical plan

1. Start with the highest-risk accounts

Enable 2FA first for owners, administrators, and anyone who can issue refunds, change payout details, manage API keys or edit user roles.

2. Choose and recommend an app

Pick one or two apps you're comfortable supporting and write a one-page setup guide with screenshots. A password manager with TOTP support is convenient for teams that already use one.

3. Set a deadline and enforce it

Announce the change, give people a week to enrol, then make 2FA mandatory. Optional 2FA tends to stay at low adoption.

4. Plan for device changes

Add "move 2FA to new phone" to your device replacement checklist, and to your offboarding process: when someone leaves, disable their account rather than just resetting 2FA.

5. Combine it with least-privilege access

2FA protects the login; permissions limit the damage if an account is misused. Pair it with sensible roles; see role-based access control for finance teams.

Common questions from staff

• "Can someone read my codes?" The codes are generated on your phone and expire in about 30 seconds.
• "Does it track my location?" Standard TOTP apps don't need location or network access to generate codes.
• "What if my phone's clock is wrong?" Set it to automatic time. Large clock drift is the most common cause of rejected codes.

How CentraPoint helps

CentraPoint supports authenticator-app (TOTP) two-factor authentication with backup codes for every team member, alongside roles and permissions (admin, staff, viewer and custom roles) and an audit log of account activity. Gateway credentials are encrypted at rest with AES-256-GCM. The security page summarises these controls.

Frequently asked questions

What is authenticator app 2FA?

It's two-factor authentication where the second step is a short code generated by an app on your phone using the TOTP standard, rather than a code sent by SMS or email.

Is an authenticator app safer than SMS?

Generally yes. Codes are generated on your device, so they aren't exposed to SIM swap fraud or interception on the mobile network.

What happens if I lose my phone?

Use one of your backup codes to sign in and set up the authenticator again on a new device. If you have no backup codes, an administrator will need to reset your 2FA.

Which authenticator app should my team use?

Any app that supports standard TOTP will work, including Google Authenticator, Microsoft Authenticator and many password managers. Choose one your team can support consistently.