What is 2-step verification (secondary authentication)?  

2-step verification is a type of security that uses 2 different types of authentication methods to verify your identity. It acts as an added layer of protection that helps keep your account safe from online fraud attempts. 

How does it work?  

The first verification happens when you sign in to Online Banking for Business and we ask for your user credentials (Company ID and User ID) and password.  
The second verification happens before you complete certain tasks, like creating users or approving payments. You’ll confirm your identity again by entering a code or scanning your face or voice using the 2-step verification method assigned to you.
 

When will I be asked to use it? 

You’ll always be asked for 2-step verification before: 

• signing in to Online Banking for Business for the first time 
• resetting your own password 
• creating or modifying a user 
• providing approvals for payments, transfers, or user changes. 

Depending on how your account is set up, you may also be asked for 2-step verification: 

• every time you sign in to Online Banking for Business  How to turn on 2-step verification at Sign In 
   

What kinds of 2-step verification are available? 

The type of 2-step-verification you’ll use to confirm your identity depends on the task you’re doing. 

• Phone verification  – When you sign in and we need to make sure it’s really you (like when you reset your password or change devices) we’ll text or call you with a one-time passcode using the phone number saved in My Profile

To complete tasks like creating or modifying a user or approving payments, transfers, or user changes, you’ll be assigned one or more of the following 2-step verification methods:  

• Biometric ID – We’ll ask you to scan your face or voice using an app you install on your smart phone. 

• BMO Passcode — We’ll ask you to enter a passcode that you’ll generate using software you install on your computer (soft token). These passcodes only work for your account and change every 30 seconds.  

• RSA SecurID — We’ll ask you to enter a passcode that you’ll generate by using either the physical token (hard token) you’re assigned or by using software that you install on your computer or mobile device (soft token). These passcodes only work for your account and change every 30 seconds.