Logging in: Face ID, two-factor, and getting back in

Logging in can use up to three things, and each one does a different job:

• Your password.
• Face ID (a passkey), a faster way to do what your password does.
• A 6-digit code, if you’ve turned on two-factor sign-in. It comes from an authenticator app, or by email with Email codes.

None of them locks you out of the others.

Face ID

Face ID lets you log in with a glance instead of typing your password. Turn it on in Settings → Security → Log in with Face ID. Or tap Turn on Face ID when the app offers it, after you add it to your Home Screen. On a computer, or a phone without Face ID, the same thing is called a passkey. It uses your fingerprint, face or screen lock.

It replaces your password, not your two-factor code. If two-factor is on, you still enter your code after Face ID. Your password keeps working too. If Face ID ever fails, tap Log in and use your password as usual.

A passkey saved in iCloud Keychain (or Google Password Manager) works on your other devices that use the same Apple or Google account. So you most often set it up only once.

Email codes

We can email you the 6-digit code, instead of an authenticator app or as a backup to one. Turn it on in Settings → Security → Email codes. We send a code first, to make sure it reaches you. Codes come from security@abovemoney.com and work for 10 minutes.

• If Email codes are your only method, we email a code as soon as you log in with your password. After Face ID, tap Email me a code.
• If you also use an authenticator app, logging in asks for the app’s code as usual. Email me a code instead is underneath, for the day the app isn’t with you.

An authenticator app is the stronger choice. Anyone who gets into your email could also reset your password. So if you use Email codes, keep your email account well protected. For the same reason, Email codes pause for 24 hours after you log in from an emailed link (like a password reset) or change your email address. Your authenticator app keeps working during that time.

How long the app keeps you logged in

In a web browser, Above Money logs you out after you’ve been away for a while. You choose how long (20 minutes unless you change it). On an iPhone or iPad, the app on your Home Screen has its own, longer timer: a week, unless you change it. That’s because your phone already has a lock screen. Change it in Settings → Security → Log out when I’m away, inside the app itself. Each device keeps its own setting. On Android and computers, the installed app shares your browser’s login, so it follows the browser setting.

You can choose Never. If you do, anyone who picks up your phone while it’s unlocked can see your balances and transactions. Changing your password or deleting your account still asks for your password.

If you get a new phone or lose one

• Face ID on a new phone: log in with your password, then turn Face ID on again. If your passkey came across with iCloud Keychain, it may already work.
• A lost phone: on any device that’s still logged in, go to Settings → Security. Remove the passkeys and authenticator apps you no longer have. A passkey alone can’t get past two-factor, but removing it is still worth doing.
• Your authenticator app was on that phone: log in with your second method. That’s another device’s app, or Email me a code instead if Email codes are on. Then remove the lost app in Settings → Security and set it up again. That’s why we suggest adding a second method as soon as you turn two-factor on.

If you can’t get in at all

• Forgot your password: use Forgot password? on the log in page. The reset link goes to your email address. Your passkeys and two-factor stay as they were. If Email codes are your only two-factor method, they pause for 24 hours after a reset. You won’t be able to finish logging in until then. That pause stops someone who got into your email from taking over your account.
• Lost your only authenticator app: email us at info@abovemoney.com from the address on your account. We’ll make sure it’s really you. Then we’ll remove the lost method, so you can log in with your password and set up two-factor again. You’ll get an email when we do.
• Lost access to your email, with Email codes on: if you also have an authenticator app, log in with it and turn Email codes off. If you don’t, contact us from another address. We’ll make sure it’s really you another way before we turn Email codes off for you.

The emails we send about this

We email you when your password or two-factor changes, including turning Email codes on or off. We also email you when you add or remove a passkey in Above Money, and whenever we change any of them for you. With Email codes on, we also email a code when you log in or ask for one. The subject line never has the code in it. None of these emails has a link.

Settings → Security always shows the full, current list of your passkeys and two-factor methods, so check there too. A code you didn’t ask for means someone has your password. Change it. If an email describes something you didn’t do, go to Settings → Security yourself. Remove anything you don’t know and change your password. More on what we keep is in What we hold about you.