Multidrop - Two-Factor Authentication (2FA)

🔐 Two-Factor Authentication (2FA)

📝 What is Two-Factor Authentication?

Two-Factor Authentication, commonly known as 2FA, adds an extra layer of security to your Multidrop account.

Instead of relying only on your username and password, 2FA requires an additional verification step when you sign in.

This helps confirm that the person accessing an account is genuinely the account owner - even if their password has been compromised.

🛡️ Why is 2FA Important?

Multidrop contains customer, order and delivery information that must be kept secure.

Passwords can be reused, shared or exposed through data breaches on other websites. 2FA significantly reduces the risk of somebody gaining access to an account using a compromised password.

It also provides better accountability and auditing, allowing activity within Multidrop to be linked to the individual user who performed it.

Every person using Multidrop should have their own user account.

Multidrop does not charge per user, so there is no need for employees to share usernames or passwords.

👤 What Does Each User Need?

For 2FA to be effective, every Multidrop user should have their own individual account.

Each user should have:

  • Their own Multidrop user account
  • A unique email address
  • Their own secure password
  • Two-Factor Authentication enabled on their account

Email addresses should not be shared between multiple user accounts.

Individual accounts allow activity to be correctly associated with the person who performed it and make it much easier to remove access when somebody leaves your business.

⚙️ Enabling 2FA for Your Users

2FA is now available within Multidrop, but it is not currently enforced globally.

It is the responsibility of each business to decide how 2FA is introduced to its users and to enable Two-Factor Authentication on the appropriate user accounts.

Once 2FA has been enabled for a user, they will be required to complete the additional authentication process when signing in.

We strongly recommend enabling 2FA for all individual users who have access to Multidrop.

🚀 2FA Implementation Progress

Multidrop's 2FA functionality has been introduced in several phases:

🟠 Phase 1 – User Details
In progress – collecting and improving the quality of individual user contact information, including unique email addresses.

✅ Phase 2 – Password Security
Complete – stronger password requirements have been implemented.

✅ Phase 3 – Internal User 2FA
Complete – Two-Factor Authentication is available for internal Multidrop users.

✅ Phase 4 – Customer User 2FA
Complete – Two-Factor Authentication is available for customer portal users.

Although the technical implementation of 2FA is complete, individual businesses must enable the feature for their users.

🔑 Why Shared Accounts Should Not Be Used

Shared accounts significantly reduce the security benefits provided by 2FA.

If several employees use the same username and password, it becomes difficult to determine who performed a particular action within the system.

It can also create problems when somebody leaves the business. If a shared password is not changed, that person may still know valid login credentials.

Using individual accounts with 2FA enabled means access can be controlled for each person separately and system activity can be attributed to the correct user.

✉️ Not Receiving Your Verification Code?

If your verification code has not arrived:

  • Check that you are looking at the correct email account
  • Check your Junk or Spam folder
  • Allow a few moments for the email to arrive
  • Check that the email address registered against your Customer Portal account is correct

If you still cannot receive your verification code, contact your account administrator or support for assistance.

🔄 Resetting Two-Factor Authentication

If a user loses access to their authentication method or needs to set up 2FA again, an authorised user can use the Reset Two-Factor Authentication option when viewing the user's account.

This removes the user's existing 2FA setup and allows them to configure it again.

A 2FA reset should only be performed after confirming that the request genuinely came from the account owner.

🔒 Protecting Your Business & Customer Data

2FA forms part of our wider approach to protecting the personal and customer information held within Multidrop.

Using individual accounts with 2FA helps reduce risks associated with:

  • Stolen or leaked passwords
  • Password reuse
  • Shared user accounts
  • Unauthorised account access
  • Former employees retaining login credentials
  • Automated login attempts and brute-force attacks

2FA works alongside good account management — it does not replace it.

Businesses should regularly review their Multidrop users and disable accounts that are no longer required.

✅ Recommended Actions

We recommend that businesses review their Multidrop users and:

  1. Ensure each person has their own user account
  2. Ensure each account has the user's correct and unique email address
  3. Remove or disable accounts belonging to people who no longer require access
  4. Avoid the use of shared usernames and passwords
  5. Enable Two-Factor Authentication for each user

Never share passwords or Two-Factor Authentication codes with another person.

❓ Need Help?

If you have problems enabling 2FA, accessing an account or completing the authentication process, please contact support for assistance.