Multi-Factor Authentication
Protect every operator account with industry-standard two-factor authentication—free on every plan. Need tighter controls? Upgrade to 3FA with location, IP and biometric verification.
What is MFA?
An essential layer of security for every account
Multi-factor authentication (MFA), also known as two-factor authentication (2FA), requires users to verify their identity with something they know (their password) and something they have (a one-time code from an authenticator app) before they can access the dashboard.
Even if a password is compromised, an attacker cannot log in without the second factor. This dramatically reduces the risk of unauthorised access to your live chat console, customer conversations, and sensitive data.
Included Free on Every Plan
No add-ons, no upgrades—MFA is available to everyone
TOTP Authenticator
Works with any standard authenticator app—Google Authenticator, Microsoft Authenticator, Authy, 1Password, and more. No SMS fees, no vendor lock–in.
Recovery Codes
During setup each user receives single-use recovery codes. If a device is lost or replaced, they can still regain access without contacting support.
Self-Service Setup
Operators and admins can enable MFA from their profile page at any time—no admin intervention required. Scan, verify, done.
Your Security, Your Rules
Choose between optional and enforced MFA
Optional Mode
MFA is available but not required. Individual operators choose whether to enable it from their profile.
- Users enable MFA at their own pace
- No disruption to existing workflows
- Ideal for smaller teams or low-risk environments
Enforced Mode
Site admins flip a single switch in System Settings → Security to require MFA for every operator account.
- Operators must set up MFA on their next login
- Cannot be bypassed or disabled by operators
- New users are automatically enrolled
- Ideal for regulated industries, government, and enterprise
Admins also get an MFA Adoption Overview dashboard showing how many operators have enrolled, how many are pending, and overall coverage percentage.
Go Further with 3FA
Three-factor authentication for organisations that demand the highest security
For organisations handling sensitive data—government, healthcare, finance, legal—two factors may not be enough. Our Bespoke packages unlock a third authentication layer, giving site administrators granular control over where and how operators can log in.
Location Verification
Restrict logins to approved geographic regions or specific office locations. Block access attempts from unexpected countries or areas.
IP Allowlisting
Lock dashboard access to specific IP addresses or ranges. Only connections from your corporate network, VPN, or approved remote IPs are permitted.
Biometric Authentication
Leverage device biometrics—fingerprint sensors, facial recognition, or hardware security keys via WebAuthn—for a passwordless third factor.
Available on Bespoke Packages
3FA controls are configured per-site by the IMSupporting team and can be combined in any combination. Location and IP? IP and biometric? All three? It’s entirely up to you.
Talk to Us About 3FAHow It Works
Set up in under a minute
Open Your Profile
Navigate to your profile page and click Enable MFA. If your admin has enforced MFA, you will be prompted automatically on login.
Scan the QR Code
Open your authenticator app and scan the QR code displayed on screen. The app will begin generating 6-digit codes that refresh every 30 seconds.
Confirm & Save Recovery Codes
Enter the current code to verify the setup. You will then receive one-time recovery codes—store them somewhere safe in case you lose your device.
You’re Protected
From now on each login requires your password plus a fresh code from your authenticator app. It takes just a few seconds.
Frequently Asked Questions
Does MFA cost extra?
No. Two-factor authentication is included free on every plan—Starter, Professional, and Enterprise. There is no per-user charge.
Which authenticator apps are supported?
Any app that supports the TOTP standard (RFC 6238) will work. This includes Google Authenticator, Microsoft Authenticator, Authy, 1Password, Bitwarden, and many others.
What happens if an operator loses their phone?
During MFA setup, each user receives a set of one-time recovery codes. Any recovery code can be used in place of a TOTP code to regain access. Administrators can also reset an operator's MFA from the user management panel.
Can I enforce MFA for some users but not others?
The sitewide enforcement toggle applies to all operator and admin accounts. Individual users can also be flagged for mandatory MFA during account creation. The main site admin account is managed separately via their profile.
How do I get 3FA features?
Three-factor authentication (location, IP, and biometric controls) is available on our Bespoke packages. Contact our team to discuss your requirements and we will configure the additional controls for your account.
Secure Your Team Today
MFA is free, takes under a minute to set up, and dramatically reduces the risk of account compromise. There’s no reason not to enable it.