What is 2FA, and why should I use it?
How two-factor authentication protects your account and your TEE wallet.
Two-factor authentication (2FA) adds a second proof of identity — a time-based code from an authenticator app — on top of your email login. Since your TEE wallet is tied to your account, anyone who can sign in as you could, in theory, move funds. 2FA means a leaked password alone isn’t enough to get in, which is why it’s required before sensitive actions like payouts.
How 2FA works
When you log in or authorise a sensitive action, Morph Payments asks for a 6-digit code in addition to your password. This code is generated by an authenticator app on your phone using a secret key that was set up when you first enabled 2FA. The code rotates every 30 seconds and is only valid during that window. An attacker who has your password but not your phone cannot generate a valid code.
Why Morph Payments requires it for payouts
Your TEE wallet is tied to your account. A payout moves real funds. Requiring 2FA at the point of payout means a compromised password alone is not enough to drain your balance — the attacker would also need physical access to your 2FA device. This is the same principle banks use for high-value transactions, applied at the account layer rather than the payment layer.
Which authenticator apps work
Any TOTP-compatible app works: Google Authenticator, Authy, 1Password, Bitwarden, Microsoft Authenticator. They all implement the same open standard (RFC 6238), so the choice is a matter of preference. Authy and 1Password offer encrypted cloud backup of your 2FA secrets, which can be useful if you change phones frequently.
Setting it up
Go to your account Security settings in Morph Payments Console and enable 2FA. You will be shown a QR code — scan it with your authenticator app to register the secret. The app will then start generating 6-digit codes for your account. Enter one to confirm the setup worked, then save your backup codes somewhere safe (a password manager or printed and stored offline).
Backup codes — do not skip this step
When you set up 2FA, Morph Payments gives you a set of one-time backup codes. If you ever lose access to your 2FA device, these codes let you get back in without going through identity verification. Store them separately from your password — not in the same app. If you lose both your 2FA device and your backup codes, account recovery requires Morph Payments’s identity-verification process, which takes time.
