What is 2-step verification (secondary authentication)?

2-step verification is a type of security that uses 2 different types of authentication methods to verify your identity. It acts as an added layer of protection that helps keep your account safe from online fraud attempts. 

How does it work?  

The first verification happens when you sign in to Online Banking for Business and we ask for your user credentials (Company ID and User ID) and password.  
The second verification happens before you complete certain tasks, like creating users or approving payments. You’ll confirm your identity again by entering a code or scanning your face or voice using the 2-step verification method assigned to you.
 

When will I be asked to use it? 

You’ll always be asked for 2-step verification before: 

• signing in to Online Banking for Business for the first time 
• resetting your own password 
• creating or modifying a user 
• providing approvals for payments, transfers, or user changes. 

Depending on how your account is set up, you may also be asked for 2-step verification: 

• every time you sign in to Online Banking for Business  How to turn on 2-step verification at Sign In 
   

What kinds of 2-step verification are available? 

The type of 2-step-verification you’ll use to confirm your identity depends on the task you’re doing. 

• Text message verification  – When you sign in for the first time or reset your own password, we’ll always ask you to enter a code that we’ll send to the mobile number saved in your user profile.  

To complete tasks like creating or modifying a user or approving payments, transfers, or user changes, you’ll be assigned one or more of the following 2-step verification methods:  

• Biometric ID – We’ll ask you to scan your face or voice using an app you install on your smart phone. 
   
• BMO Passcode — We’ll ask you to enter a passcode that you’ll generate using software you install on your computer (soft token). These passcodes only work for your account and change every 30 seconds.  
   
• RSA SecurID — We’ll ask you to enter a passcode that you’ll generate by using either the physical token (hard token) you’re assigned or by using software that you install on your computer or mobile device (soft token). These passcodes only work for your account and change every 30 seconds.