Hi Mike,
thanks for your reply. We are NOT going to set up an individual login for every individual. all 4 of them work on average once a month or less. And as mentioned one of them doesn't even use a cellphone. Yes I have a 2FA set up. But currently I only have to use this when logging in online. I have never used it when logging in on our PC programme.
What are our options? Can't we get a 2FA via an email? that is what we currently do on the 30 day cycle. I am not wanting to be called every single day someone needs a 2FA.
Hi Verdant ,
It is of course your decision to continue having the team share a login, but I want to confirm that it is MYOBs and the ATOs guidelines that there are no shared logins.
Regarding the method, you can continue to use email 2FA as this is already set up. We highly recommend having a secondary method (SMS is great) so that you have a back up option available.
If for example, you were unable to access your emails or you couldnt receive the 2FA email, you would then have the secondary option of using SMS.
This is also especially helpful for accessing My Account where you can manage your 2FA preferences without needing to contact MYOB.
As you said, you currently do email 2FA on a 30 day cycle.
The notification you have received is more around the frequency of 2FA.
Instead of every 30 days, this will now be at least once per day (every 24 hours)
Is email always going to be an option for 2FA for new staff accounts going forward? Or, will we need to require staff to have a phone for work use when employing new people?
Hi bigmac , with a high rate of change in the cyber security environment, we cannot confirm that email will always be an option going forward.
Email is currently available but it's not recommended as it is less secure than SMS or Authenticator Apps (both of which do require a phone).
Using a phone isn't ideal at all. I don't see how SMS is any more secure than an email. Someone could steal your phone, and a notification pops up on your screen with a code. Accessing email on a PC requires firstly to be able to login to the PC and then a further log in to emails.
Having requirements for staff to use their own personal phone for such things is not fair to them. We'd have to compensate staff or buy a shop phone just to get into MYOB. Yet another cost to small business. After 18 years of using MYOB this might be deal breaker for us.
