How to use an authenticator app with your CRA account
Last checked
Short answer
Where the setting is
The CRA offers an authenticator app as one of its multi-factor authentication options when you register for a CRA account, and you can add it later in your MFA settings.
The CRA’s help page says: “Multi-factor authentication (MFA) increases the security of your CRA account by requiring you to enter a one-time passcode every time you sign in. MFA is mandatory for all CRA account users.” The three options are a third-party authenticator app, a passcode grid, and a phone (a text or a call). This guide is about the authenticator app.
Search for and download a free third-party authenticator app from a reputable app store.
Set up the app to use with your CRA account. You do this one time. Either scan the provided QR code with a mobile device when prompted, or manually enter the setup key the CRA provides to you into the app.
Every time you sign in to your CRA account and are prompted for a passcode, open your authenticator app to get the 6-digit code. For security, the app will generate a new passcode every 30 seconds.
The CRA gives these checks for choosing an app. Get it from an official app store; the CRA names Google Play, the Microsoft Store and the Apple App Store. Then follow its advice to “Read the privacy agreement before you download to make sure your data is handled securely”, “Read recent reviews to check for reported security concerns”, and “Check the number of reviews or downloads (a low number may be a concern)”. It adds: “You do not need to spend money to get a reputable authenticator app.”
Backup
Set up a backup option
The CRA’s help page doesn’t mention backup codes. It does say: “A backup method can help you if you forget or lose access to your primary MFA method.” It suggests enrolling in more than one option, and its passcode grid is a printed list you save. If you ever lose the phone, see our guide on what to do if you lose your phone.
