Using Multi-Factor Authentication (MFA)

Multi-Factor Authentication or MFA, is a security measure implemented on all Portal users and API-integrated Partners that creates an additional layer of user verification by supplying a six-digit code to an authenticator app of your choice to verify you’re the user logging in or initiating a request/action.

Navigate to the Multi-Factor Authentication Enablement page by clicking Settings in the Admin category of the left-hand navigation panel. Then, click Multi-Factor Authentication Enablement under the Business Details section.

This is a beta feature and will not be required until deployed for general availability. Users with parent entities (Referrers or Facilitators) enrolled in MFA beta will likely be required to enroll.

Note: The page does not dynamically load the entire list of all MFA-enabled users.

By using the search button in the search bar, you can either load with no criteria to populate the entire list, or enter in a specific user you’re looking for to filter.

Note: Facilitators & Referrers utilizing their own MFA configurations in place can use Single Sign-On (SSO) to automatically redirect to the Portal directly from their native application without manual sign-in or authentication required.

Enable MFA for your Portfolio

After navigating to the Multi-Factor Authentication Enablement page, you’ll see a list of existing users in your portfolio and whether or not they have enrolled in and enabled MFA.

Step 1: From the Dashboard, navigate to Users (under Management)

Step 2: Click the Add User in the upper right corner.

Step 3: After entering the desired new user info, select “Yes” from the Multi-Factor Authentication Enabled dropdown.

Step 1: From the Dashboard, navigate to Settings (under Admin).

Step 2: Click Multi-Factor Authentication Enablement.

Step 3: Select the desired user from the list by clicking the checkbox.

Step 4: Click Enable on your selected user listing.

Step 1: From the Dashboard, navigate to Users (under Management).

Step 2: Click on the desired user from the page list to be redirected to their User Profile.

Step 3: Under the User tab (This will be the name of the User) in the User Profile menu. Then, click the edit icon in the upper right-hand corner.

Step 4: (Optional) Click API Roles and Add the “Multi-Factor Authentication” role if you are assigning a Referrer-level user the ability to manage its Merchants' MFA enablement.

Step 5: Click the Multi-Factor Authentication Enabled field and select Yes from the dropdown. Then, click the check icon in the upper right corner to confirm the change.

Enroll Users in MFA

After enabling the MFA feature for the desired user, the user will be required to enroll in their preferred authenticator app (such as Microsoft/Google Authenticator, Okta Verify, or RSA SecurID) the next time they attempt to log in to the Portal.

To enroll in MFA using SMS text messaging as the authentication method, follow the steps below:

Step 1: Upon viewing the Portal prompt to secure your account, click Continue.

Step 2: Select Text (SMS) from the Select MFA Method prompt.

Step 3: Confirm the phone number pulled from your User Profile and click Confirm.

Step 4: (Optional) If your phone number does not match or is incorrect, click Modify to change the phone number. Then, click Confirm.

Step 5: After clicking Confirm, you will be sent the following SMS text message to the number you’ve confirmed:

“Payrix Verification Code: Use this one-time verification code to complete sign-in: XXXXXX. Do NOT share this code with anyone. This code is valid for 10 minutes. Reply STOP to opt out.”

Step 6: Use this code to authenticate and complete the MFA enrollment.

Step 1: Upon viewing the Portal prompt to secure your account, click Continue.

Step 2: Select Mobile App from the Select MFA Method prompt.

Step 3: Download your preferred authentication app from the Apple App Store or Google Play Store.

Step 4: After downloading and setting up your authenticator app, enroll using a QR code and scan the code presented on the Scan the QR Code prompt:

Step 5: Enter the current six-digit code generated on your authenticator app to authenticate and complete the MFA enrollment.

Recommended MFA Authenticator Apps

There are many different multi-factor authentication apps available to choose from. Below is a list of trusted authentication apps we recommend for individuals to use in MFA enrollment:

Reset User MFA Setup

In situations where users lose their device that contains the authentication code setup required for MFA, you can disable MFA for that user to allow them to re-enroll. If and when the user is ready to re-enroll, simply re-enable their MFA enrollment and the process shown above will be prompted again for the user to set up MFA.

Below are the recommended steps for each platform user access level to reset their individual MFA setup:

User Type	Reset Steps

User Type	Reset Steps
Facilitator	Contact a Facilitator-level user with the proper access to reset.
Referrer	Contact Payrix support via ServiceDesk ticket or your Facilitator.
Merchant	Contact your Referrer.

Facilitators & Referrers can manage Merchant-level MFA enablement for convenient support of their portfolios.

Below are the steps a Facilitator or Referrer can take in the Portal to reset another (Merchant) user’s MFA setup:

Disable User MFA Setup

For scenarios where a Facilitator may want to use their own MFA solution or other unique situations you can follow the steps below:

“Login As” Access

After users have become enrolled in Multi-Factor Authentication, they will also be prompted to submit an MFA code when logging in to their child entities' Portal views (e.g. Referrer logging in as one of its Merchants). The same rules will apply that a user can use Remember Me for 30 Days to only be required to authenticate this way one time every 30 days.

Remember Me

After enrolling in MFA, and attempting an additional login to the Portal prompting for the current temporary authenticator code to be entered. Users can toggle a checkbox that says “Remember me for up to 30 days” to ensure that a user are not prompted to enter a temporary authenticator code for MFA the next time they log in within the next 30 days.

Toggle the “Remember Me” checkbox, then enter the authenticator app code. This prevents the selection from not being saved.

Enable the MFA Announcement Lightbox

Multi-Factor Authentication is not yet fully enabled as a requirement for all users and will deployed to all soon. To inform your portfolio users that they will need to enroll in MFA soon. This lightbox will provide the option for the user to begin enrollment steps now, or decline and wait until it is required.

To enable this announcement lightbox, follow the steps below:

Now, the next time a Referrer or Merchant in your portfolio logs into the Portal, they will see a lightbox allowing them to enable and enroll in MFA from directly inside the prompt.

More on Multi-Factor Authentication (MFA)

Multi-Factor Authentication (MFA) should be utilized by all Facilitators and Referrers to structure an additional layer of security to increase the security of your information and prevent hacks and malicious attacks on your accounts.

MFA Platform Requirements

MFA is required when using a Session ID within the Portal or Payrix API.

MFA Browser Compatibility

MFA works with most browsers, but be sure to review pop-up blockers that may prevent the MFA announcement or “Remember Me” message from displaying.

MFA Enablement Deadline

MFA must be enabled for all users within your portfolio by April 2024.

After this time, any user not enrolled or enabled will be prompted to enroll in MFA and select their preferred authentication option: SMS/Text or Authenticator App). This is an automated requirement and cannot be skipped.

MFA Enrollment Reset and Management

MFA reset and re-enrollment is only required for users who damage their device, lose their device, purchase a new device, or have their device stolen.

The new /mfa API endpoint allows users to manage or reset their MFA setup. (This requires users with the need to submit an Implementations Ticket to be enabled.)
No scenario exists that would require a User to re-enroll in MFA after initial successful enrollment.

MFA Login Flow Changes

The “Remember Me” login function is still available for all users, including partners and merchants.
The “Login As” Portal function is still available for users with enabled and validated MFA to log in.
Merchants using Single Sign-On (SSO) to login to the Portal through their Referrer are not required to use MFA.

API Use Flow Changes with MFA

Facilitators and Referrers setting up platforms with the sole purpose of API usage are not required to use MFA as their private API key will act as their authentication method.

For Facilitators and Referrers that choose this option, disable Portal Access and Login As Access from the User Profile of any API-only user or enroll them in MFA for maximum security as normal.