Multi-factor authentication (MFA) strengthens your VA.gov account security by requiring two methods to verify your identity. These factors can include something you know, like a username and password, plus something you own, like a smartphone.
MFA protects against phishing, social engineering, and password brute-force attacks and secures your logins from attackers exploiting weak or stolen credentials.
How it works
When you want to sign in to your account, you'll need to provide two pieces of information—your username and password and a verification code from your trusted device, such as an iPhone, Android, or other smartphone.
By entering the code, you are verifying that you are both in possession of the device and accessing your account. For example, if you have an iPhone and are signing into your account, you'll be prompted to enter your password and approve the login event from the ID.me Wallet app or by entering the verification code that's automatically displayed on your iPhone.
Because your password alone is no longer enough to access your account, multi-factor authentication dramatically improves the security of your account.
Once signed in, you won’t be asked for a verification code on that account again unless you sign out completely or need to change your password. When you sign in on the web, you can choose to trust your browser, so you won’t be asked for a verification code the next time you sign in from that computer.
A trusted device is a device that you've already used for multi-factor authentication. Trusted devices like smartphones and tablets can be used to verify your identity by displaying a verification code from ID.me.
Trusted phone numbers
A trusted phone number is a number that can be used to receive verification codes by text or phone call. You must verify at least one trusted phone number to enroll in multi-factor authentication.
You should also consider verifying other phone numbers you can access, such as a home phone, or a number used by a family member or close friend. You can use these numbers if you temporarily can't access your own devices.
A verification code is a temporary code sent to your trusted device or phone number. You can also get a verification code from Settings on your trusted device.
A verification code is different from the device passcode you enter to unlock your iPhone, iPad, or iPod touch.