Passwords get guessed, reused and stolen. If your account holds money, a password alone is not enough. Two-factor authentication and passkeys add a second lock that only you can open, so even someone who knows your password cannot withdraw your earnings.
What is two-factor authentication?
Two-factor authentication (2FA) means proving it is you in two different ways: something you know (your password) and something you have (your phone). With an authenticator app, your phone shows a new 6-digit code every 30 seconds. To withdraw, you enter the current code. A thief with your password but not your phone is stuck.
What is a passkey?
A passkey is a newer, simpler kind of second lock. Instead of typing a code, you confirm with your phone's fingerprint, face unlock or screen PIN. The passkey is stored safely on your device and never leaves it, so there is nothing for a scammer to trick you into sharing. Passkeys also cannot be used on fake look-alike websites, which makes them strong protection against phishing.
Which should you use?
| Authenticator app | Passkey | |
|---|---|---|
| How you confirm | Type a 6-digit code | Fingerprint, face or screen PIN |
| Works on old phones | Yes | Most phones from recent years |
| Protection from fake sites | Good | Excellent |
| Speed | A few seconds | One tap |
Either works on Microtask. Many people set up both, so they have a backup.
How to set it up on Microtask
- Open Settings and go to Security.
- For an authenticator: choose authenticator app, scan the QR code with an app like Google Authenticator or Microsoft Authenticator, and enter the code it shows.
- For a passkey: choose add passkey and confirm with your fingerprint, face or PIN.
- Once set, every withdrawal asks for your code or passkey.
Removing a passkey also needs a code sent to your email, so nobody can quietly remove your protection.
Common ways accounts get taken over
- Reused passwords. When one site is hacked, attackers try the same password everywhere.
- Fake login pages. A link that looks real but leads to a copy of the site.
- "Support" asking for a code. Someone pretends to help and asks you to read out the code you just received.
- Unlocked phones. Anyone who picks up your phone can open your apps.
Two-factor authentication and passkeys stop most of these, especially the first two.
What to do if you think your account is at risk
- Change your password straight away to a new, unique one.
- Check that your authenticator or passkey is still set up in Settings.
- Review your email for alerts you did not expect, such as a password change or passkey removal.
- Contact support if anything looks wrong.
Choosing a strong password
Length beats complexity. A phrase of four random words, like "mango-bridge-cloud-seven", is far stronger and easier to remember than "P@ss123". A password manager can create and remember unique passwords for every account.
Habits that keep your account safe
- Use a unique password for every important account.
- Never share codes. No real support team will ever ask for your authenticator code, email code or OTP.
- Check the website address before you log in. Bookmark the real site.
- Watch your email. We email you when your password changes or a passkey is removed. If it was not you, reset your password straight away.
- Keep your phone locked and your apps updated.
Security also includes your identity. Read what KYC is and how to spot scams.