Two-Factor Authentication

What is 2FA and why it matters

Two-Factor Authentication (2FA) adds a second verification step to your login. Even if someone obtains your password, they cannot access your account without the second factor — a code from your phone or authenticator app.

When you log in with 2FA enabled:

1. Enter your email and password as usual
2. The system asks for a 6-digit code
3. Enter the code from your authenticator app or SMS
4. Access is granted

Available 2FA methods

Setting up an authenticator app

Step 1: Install an authenticator app

Any TOTP-compatible app works. Popular options:

• Google Authenticator — free, simple, iOS & Android
• Microsoft Authenticator — iOS & Android, supports cloud backup
• Authy — iOS, Android, Desktop, multi-device sync
• 1Password — best if you already use a password manager

Step 2: Enable 2FA in your account

1. Open My Account → Password & 2FA
2. Find the Two-Factor Authentication section
3. Click Enable 2FA
4. Select Authenticator app
5. Enter your current password to confirm

Step 3: Scan the QR code

1. A QR code appears on screen
2. Open your authenticator app and tap + or Add account
3. Select Scan QR code and point the camera at it
4. shookout.com appears as a new entry in the app

If you cannot scan the QR code, click Enter code manually beneath it, copy the secret key, and enter it manually in the app. Set the type to Time-based.

Step 4: Verify and confirm

1. Find the shookout.com entry in your app — it shows a 6-digit code that refreshes every 30 seconds
2. Enter this code on shookout and click Confirm
3. 2FA is now active

Step 5: Save your backup codes

1. After confirming, a list of 10 backup codes is shown — this is the only time they are displayed in full
2. Click Download codes to save a .txt file, or copy them manually
3. Store them securely — see the Backup Codes section below

Setting up SMS 2FA

1. Open My Account → Password & 2FA
2. Click Enable 2FA and select SMS
3. Enter your phone number in international format (e.g. +15551234567)
4. Click Send code — a 6-digit code arrives by text
5. Enter the code and click Confirm
6. Save your backup codes

SMS limitations to be aware of:

• Delivery can take 1–5 minutes
• May not work abroad or in roaming
• Vulnerable to SIM-swap attacks — do not rely on SMS as your only 2FA method

Logging in with 2FA

Standard login

1. Go to shookout.com and click Log in
2. Enter your email and password
3. When prompted, open your authenticator app and enter the 6-digit code
4. Click Confirm — you are in

Remember this device

At the 2FA prompt you can check Remember this device for 30 days. The code will not be required again on this device for 30 days. New or unrecognised devices always require a code.

To manage trusted devices go to My Account → Devices — you can see all trusted devices and remove any of them.

Logging in with a backup code

1. At the 2FA prompt click Use backup code
2. Enter one of your saved codes
3. The code is consumed and can no longer be used

Backup codes

Backup codes are emergency one-time codes for situations where your primary device is unavailable — lost phone, dead battery, phone reset, or no mobile signal.

Code format

• 10 codes included, format XXXX-XXXX
• Letters and digits, case-insensitive
• Each code is single-use

Where to store backup codes

Safe options:

• A password manager (Bitwarden, 1Password, etc.)
• An encrypted note or file
• Printed and stored in a safe place at home

Avoid:

• Unprotected notes on your phone
• Plain text files on your desktop
• Email drafts or screenshots in your gallery
• Unencrypted cloud storage

Generating new backup codes

1. Open My Account → Password & 2FA
2. Find Backup codes and click Generate new codes
3. Confirm the action — existing codes are immediately invalidated
4. Save the 10 new codes

Managing 2FA

Adding a second method

1. Open My Account → Password & 2FA
2. Click Add method and select SMS
3. Follow the SMS setup steps above

Disabling 2FA

1. Open My Account → Password & 2FA
2. Click Disable 2FA
3. Enter your password and a valid 2FA code to confirm

Recovering access

Lost your phone?

Option 1 — Backup code: at the 2FA prompt click Use backup code, enter a saved code, log in, then immediately reconfigure 2FA on your new device and generate fresh backup codes.

Option 2 — SMS (if set up): at the 2FA prompt select Receive code by SMS.

Option 3 — Contact support: if you have neither backup codes nor SMS access, click Can't log in on the login page and select Issue with 2FA. You will need to provide identity verification. The support team responds within 24–48 hours — the recovery process may take several days.

Changed your phone number?

1. Log in using your authenticator app or a backup code
2. Open My Account → Password & 2FA
3. Find the SMS method and click Change number
4. Enter your new number and verify with the code sent to it

Resetting your phone?

A factory reset deletes your authenticator app and all its entries. Before resetting:

1. Make sure your backup codes are saved and accessible
2. Use Authy or Microsoft Authenticator — both support cloud backup so your entries are not lost on a reset
3. After resetting, reconfigure 2FA from My Account → Password & 2FA

Frequently Asked Questions

Is 2FA required on shookout?

It is not mandatory, but strongly recommended — especially for sellers. Your account controls your earnings balance.

Can I use one authenticator app for multiple accounts?

Yes. You can add as many accounts as you like to a single app — each appears as a separate entry.

What if the code is not accepted?

Check that your phone's clock is set to sync automatically. An incorrect system time produces invalid codes.

Can I use 2FA on multiple devices?

Yes — scan the same QR code on multiple devices, or use Authy which syncs across devices via cloud backup.

What if I lost my backup codes and still have account access?

Go to My Account → Password & 2FA → Backup codes → Generate new codes immediately.

Is cloud backup in the authenticator app safe?

Yes, provided your authenticator account itself has a strong password and 2FA enabled. Authy and Microsoft Authenticator both offer this.

Do I need to enter a code on every login?

Not on trusted devices — checking Remember this device for 30 days skips the code prompt for 30 days.

Support asked for my 2FA code — is that normal?

No. Real shookout support will never ask for your 2FA codes or password. Anyone asking is a scammer.