1. Multi-Factor Authentication (MFA)
Updated 09/05/ :00 AM EST
Modified by HM Riggert 10/17/17

2. Multi-Factor Authentication (MFA)
What is it?
Utilizing something other than normal login information to authenticate yourself. 
Why implement MFA?
Due to the heightened awareness of personal identity theft and the growing world of cyber threats,
With sites using borrowed computers and/or computers in locations such as libraries and community centers, MFA adds an additional layer of protection.
It takes less than 10 minutes for a cyber criminal to crack an eight characters strong password

3. Implementing MFA What is the implementation plan?
Currently, the MFA is fully implemented except for selecting the re-authenticate interval
Login changed to just be User Name and Password and volunteer secret questions are deleted.
What can site admins do before the start of tax season?
Review the active users currently setup at your site to ensure they have unique addresses.  
The MFA system will validate the uniqueness of the address during the authentication process.  
Receiving a text message with the code is also an option and will also require a unique cell phone number.

4. Step 1: Updating your Preparer Information
At first login since last season
You will be prompted to complete an Account Update page
Enter or change the cell phone number
Enter or change the address
Enter your existing password
Click Update
Note: addresses must be unique unless designated for multiple use by the administrator

5. Finishing the Update Process
MFA will trigger for the user in 7 days after completing the update page
By default, it is set to re- authenticate after 7 days.
Site Admin will have the ability to change this from 1 to 30 days depending on the site needs.

6. Automatic updates to the Preparer Information
Information entered or changed during the update process automatically updates the information for the user name in the Preparer(s) menu.

7. MFA Challenges My volunteers have multiple user names
Site Administrator has the ability to designate an address to be used with multiple user names
I am not sure if my host site will allow access to retrieve the code from the account on file.
Allow your SPEC relationship manager to work with your host site.

8. Designating an email address to be used by multiple usernames
Site administrator can allow multiple usernames to use the same address if:
The same person volunteers at multiple sites
The same person has multiple usernames per site due to tracking different SIDNs for ‘ad hoc’ locations

9. Step 2: Time to Authenticate
When required to authenticate, the Account Verification page will be displayed
Select a delivery option
If a cell phone number is not listed for the user, they will not see the Text option
Select Send Code
The user will see a verification that the code has been sent – Code is sent within a few seconds

10. Step 3: Enter the Authentication Code
Enter the verification code
Click Verify
Once the code is authenticated the user will be taken to the Welcome page

11. When is authentication required?
The first time a user logs in from a different computer
I logged in to a different computer and had to authenticate. I went back to the original computer and did not have to authenticate.
When their authentication has expired
Defaults to 7 days
When a computer is re-imaged
Three failed login attempts

12. Questions and Answers
Q: Would a TaxSlayer update wipe out the MFA Authentication?
A:  No, we do not anticipate this happening.
Q:  Would a computer or browser update wipe out the MFA Authentication?
A:  We have not experienced this with our other software applications currently using MFA.  If the host site performs some type of maintenance on the computers on a nightly basis (such as wiping them and applying a fresh profile), the users will have to authenticate each day
Q: Can I turn MFA off at my site?
A: No

13. Authorization Code FAQs
Q:  Does the authorization code reference the user that it is for?
A:  No, Both Text and notifications indicate it is a code for TaxSlayer (No URL) and a 6 digit code.
 Q:  Once a code is used, does it immediately become cancelled, or can it potentially be used more than once?
A:  The authorization code is a one-time use code.
Q:  Is there a number of times the user can attempt to enter the code before the application locks?
A:  We do not lock the application based on attempts to enter the authentication code. However, if you have 3 missed login attempts, you will be prompted for MFA
Q:  Is there a limit for how many requests can be made for a specific user name?
A:  No, not at this time.