What is two-step verification?
Two-step verification, also called multi-factor authentication (MFA), asks for your password plus a second step, like a code sent to your phone. This makes it much harder for someone else to sign in as you.
A two-step sign-in is a trust and security feature that typically requires you to present a combination of something you know, like your password, along with something you have, such as a one-time code sent by text or email or a passkey saved on your phone. Passkeys are saved on your phone or computer, and you unlock them with your fingerprint, face, or device PIN. (Passkeys are available in Realm.)
The bottom line is that two-step verification asks for your password plus one more step so that a stolen password isn't enough for a bad actor to sign in and access your account.
In Realm, two-step verification is required for administrators, staff, and anyone with responsibilities. For everyone else, it's optional unless your church requires it. When congregants turn it on, they help protect one another's privacy and keep information like contact details, giving records, and volunteer schedules safe.
You can set up a passkey, email, or text message, and you can set up more than one. See Manage Your Verification Methods.
Signing in with Google, Apple, or Microsoft isn't the same as two-step verification. If two-step verification is required for you, you'll still verify with a text, email, or passkey.
Why does MFA matter for churches?
Churches are attractive targets. Members trust their church, staff and volunteers change often and sometimes share logins, and church records can include pastoral care notes, children's information, and giving history.
Your church software holds more than your own information. It holds names, phone numbers, email addresses, and family details for the people in your congregation. When someone signs in with your account, they can see and change what you can.
When scammers get into a staff or part-time volunteer's account, they can contact your members with messages that seem to come from the church. Members respond to these messages because they usually trust their pastors and staff.
A password alone isn't enough to stop this. Two-step verification asks for a second step, like a code sent to your phone, before anyone can sign in as you. Even if someone steals your password, they can't get in without that second step.
If you manage your church's software, require two-step verification for everyone who can edit records. It's one of the most important things you can do to protect your congregation.
Why do I have to identify myself in multiple ways to login?
Passwords are easy to guess and reuse. Scammers also use social engineering and other tactics to build a profile of you and get into your accounts. That's why you need more than one way to prove it's you when you sign in.
Many people use passwords that are easy to guess, reuse the same password on several sites, or change only the last character when they update it. A username and password alone no longer protect your sensitive information. Scammers combine stolen passwords with phishing attempts and other tactics to collect details about your life and build a detailed profile of you.
Why don't I see any verification methods?
A browser extension, such as an ad blocker, may be hiding the list of methods on the two-step verification screen.
If the two-step verification screen doesn't list any methods, a browser extension, such as an ad blocker, may be hiding them. Try signing in from a private or incognito window. If that works, turn off the extension or add the Realm sign-in page as an exception in its settings.
What if I lose my recovery codes?
Lost recovery codes can't be recovered, but your two-step verification can be reset.
If you've lost your recovery codes, you can't get them back. Ask your church to contact Support, who can reset your two-step verification. Then sign in and set it up again.
Why didn't I get the verification email?
Check your spam folder, and add the sender's address to your safe senders list.
Verification emails come from mail.ministrylogin.com. If you don't see one, check all of your mail folders, including spam.
If it still doesn't arrive, add mail.ministrylogin.com to your safe senders list. This tells your email provider that mail from this address is safe, so it isn't blocked or marked as spam. The steps are different for each email provider, so check your provider's instructions.
Do I have to use the phone number on my account for text verification?
No. You can use any mobile number where you can get texts.
The mobile number you use for two-step verification doesn't have to match the phone number on your profile. Use any mobile number you can get texts on.
How do I enable two-factor authentication (MFA)?
Find your product below to learn how to turn on two-step verification, also called two-factor authentication or MFA.
Realm, Gather, and MissionInsite use ACST One Account Management. Signing in with a text code or passkey is a sign-in method. Two-step verification is a separate second step after you sign in, and you set it up in your user account.
- MinistryPlatform
- Realm, Gather, and MissionInsite: set up two-step verification with a passkey, email, or text.
- Realm Connect (for Leaders and Congregants)
- Go Method