Signing in: Face ID, two-factor, and getting back in

There are up to three things involved in signing in, and each one does a different job: your password, Face ID (a passkey) as a faster way to do what the password does, and a 6-digit code from an authenticator app if you’ve turned on two-factor. None of them locks you out of the others.

Face ID

Face ID lets you sign in with a glance instead of typing your password. Turn it on from Settings → Security → Face ID sign-in, or tap Turn on Face ID when the app offers it after you add it to your Home Screen. On a computer, or a phone without Face ID, the same thing is called a passkey and uses your fingerprint, face or screen lock.

It replaces your password, not your two-factor code. If two-factor is on, you still enter your code after Face ID. Your password keeps working too, so if Face ID ever fails, tap Log in and use your password as usual.

A passkey saved in iCloud Keychain (or Google Password Manager) is shared with your other devices signed in to the same Apple or Google account, so you usually only set it up once.

How long the app stays signed in

In a web browser, Above Money signs you out after a period of inactivity you choose (20 minutes unless you change it). On an iPhone or iPad, the app on your Home Screen has its own, longer timer, a week by default, because your phone already has a lock screen. Change it from Settings → Security inside the app itself; each device keeps its own setting. On Android and computers, the installed app shares your browser’s sign-in, so it follows the browser setting.

You can choose Never. If you do, anyone who picks up your phone while it’s unlocked can see your balances and transactions. Changing your password or deleting your account still asks for your password.

If you get a new phone or lose one

• Face ID on a new phone: sign in with your password, then turn Face ID on again. If your passkey came across with iCloud Keychain, it may already work.
• A lost phone: from any device that’s still signed in, go to Settings → Security and remove the passkeys and authenticator apps you no longer have. A passkey on its own can’t get past two-factor, but removing it is still worth doing.
• Your authenticator app was on that phone: sign in on another device with your second method if you added one, then set up the app again. This is why we suggest adding a second method, on another device, as soon as you turn two-factor on.

If you can’t get in at all

• Forgot your password: use Forgot password? on the sign-in page. The reset link goes to your email address. Your passkeys and two-factor stay as they were.
• Lost your only authenticator app: email us at info@abovemoney.com from the address on your account. We’ll confirm it’s really you, then remove the lost method so you can sign in with your password and set two-factor up again. You’ll get an email when we do.

The emails we send about this

We email you when your password or two-factor changes, when you add or remove a passkey in Above Money, and whenever we change any of them for you. Those emails never contain a link. Settings → Security always shows the full, current list of your passkeys and two-factor apps, so check there too. If an email describes something you didn’t do, go to Settings → Security yourself, remove anything you don’t recognize and change your password. More on what we keep is in What we hold about you.