New Horizon Experience. This article describes the New Horizon Experience, which is available now. In the Horizon WebRef mobile apps for Android and iOS, New Horizon is already what you see. On a computer or laptop you see it when you are in New Horizon. If you still have the older layout, choose Try the New Horizon Experience from the banner or your account menu. You can switch back from that menu any time.
Multi-factor authentication (MFA) lives on your own Personal Profile, in Security. Every signed-in member can turn it on or off for their own account. Organization administrators do not switch it on for someone else, and there is no System Settings control for it.
Use this article when you want a second step after your password, when a sign-in or a sensitive change asks for an Authentication PIN, or when you need to turn MFA off after you lose the phone or app that makes the code. If you cannot sign in at all, start with How to reset your username/password. For the rest of the profile, see Personal Profile.
What MFA does
Multi-factor authentication is sometimes called two-factor authentication (2FA), Google Authentication, or a Google Authentication Code. It is an optional extra sign-in step. After you present two kinds of proof, Horizon lets you in:
Knowledge (something only you know, such as your username and password)
Possession (something only you have, such as a PIN from the authenticator app on your phone)
That second step better protects account data, which may include personal identification or financial information, from someone who only has a password.
MFA is recommended on your profile checklist. It is not required to finish a routine profile review unless your organization has asked you to complete it.
Where do I find the Authentication PIN?
An authenticator app on your phone (or another device) shows a randomly generated 6-digit Authentication PIN that changes about every 30 seconds. You can use any authenticator that works with a QR code. A common choice is the Google Authenticator app.
Note. Set the date and time on that device to automatic. If the clock is wrong, the 6-digit PIN can expire before you type it.
When you sign in with MFA on, Horizon asks for that PIN after your password. The field is labeled Authentication PIN, with placeholder 6 digit PIN. If you cannot reach the app, use Lost your PIN? and recover the account, then come back to Security.
How to turn MFA on
Sign in, then open Personal Profile from your account menu (your name or photo). On a phone, open the Security tile from Overview. On a computer, choose Security in the left list. The heading on that screen is Account security.
Scroll to Multi-factor authentication (MFA). The card says it is optional and that it protects your account with an authenticator app code at sign-in. When MFA is off, you will see an Optional badge and Enable MFA.
On a computer, the same MFA card sits beside Phone verification, with Enable MFA in view without scrolling past the whole page.
Choose Enable MFA. A setup window titled Multi-factor authentication (MFA) walks you through three steps. You can also open the in-product How MFA works help link from that card if you want this article while you work.
Get an authenticator app. Install Google Authenticator, Microsoft Authenticator, Authy, or a similar app if you do not already have one.
Scan this QR code in your app. Add a new Horizon account in the app and scan the code. If you are setting MFA up on the same phone and cannot scan, choose Can't scan? Show setup key, then type or Copy the setup key into the app.
Enter the 6-digit code from your app. Type the current code into Verification code (placeholder 6-digit code), then choose Verify and enable MFA.
When that succeeds, Horizon shows that multi-factor authentication is now enabled. From then on, sign-in asks for the current code after your password.
How to turn MFA off
You turn MFA off in the same place you turned it on: Personal Profile, then Security. You must be signed in.
When MFA is on, the card shows a Verified badge and Turn off multi-factor authentication. Open that control. The window says Multi-factor authentication is on and asks for the current 6-digit code from your authenticator app. Enter it, then choose Turn off MFA. Horizon asks Turn off multi-factor authentication? and explains that you will only need your password to sign in, which reduces account security. Confirm if you still want it off.
If you lost the authenticator and you already have a verified phone on the profile, the same window may offer Use verified phone instead. Horizon can send a one-time code by Send text or Call me. That path is not available if your phone or password was changed recently, or if no verified phone is on the account. Verify a phone on Security first when that is the block.
If you still cannot turn MFA off yourself, contact Horizon support. Support can run an alternative identity check with a driver's license or passport, then help turn MFA off for you.
What if I lose my PIN or authentication device?
If you lose the phone or other device that makes the code, use our regular username/password recovery option. After you recover the account and sign in, open Personal Profile, then Security, and either turn MFA off or set the authenticator up again. If you still cannot finish that yourself, contact Horizon support for the driver's license or passport identity check described above.
If the PIN is rejected even though you still have the app, the saved Horizon entry in that app may no longer match. Remove the existing HorizonWebRef entry from the authenticator app, sign in, and enable MFA again with the new QR code or setup key. Keep the device date and time on automatic so the 30-second window stays in sync.
Do I have to use Google Authenticator?
No. Google Authenticator is one well-known example. Horizon works with any authenticator app that provides one-time codes and can start from a QR code. Most of those apps are free. Other common choices include Microsoft Authenticator, Authy, LastPass Authenticator, Duo Mobile, 1Password, FreeOTP, Authenticator Plus, and Ubiquiti Verify.
When you sign in, use the same app you used when you enabled MFA. A code from a different app will not match.
Extra checks on Personal Profile and Payment Center
On Personal Profile and Payment Center, Horizon often asks you to confirm it is you before a high-sensitivity action. If MFA is on, that check may ask for the authenticator PIN before you change name, email, or phone, or before you add funds, withdraw funds, or send payments. The prompt is Confirm with authenticator: enter the 6-digit code from the app to continue.
On Payment Center, do not confuse that authenticator PIN with your organization's Authorization PIN. The Authorization PIN is a separate 4-digit number created and controlled by the business Account Controller (the person who set up the business payment center account).
If you still see the older layout
On a computer or laptop, the older legacy layout stays until you choose Try the New Horizon Experience from the banner or your account menu. This article describes the New Horizon screen. Until that older layout is retired, look for the 2-Step Login Authentication tab on Personal Profile. The controls there say Turn ON and Turn OFF instead of Enable MFA and Turn off multi-factor authentication.