BILL 2FA: how to set up an authenticator app

BILL (older help articles still call it Bill.com) is where many businesses pay bills, send invoices and get paid. You can't opt out of the second step there: every account needs at least one method of what BILL calls multi-factor authentication (MFA) or 2-step verification, either a phone number for texts or calls, or an authenticator app (BILL). BILL recommends the app if you travel outside the US, and it only places voice calls to US and Canadian numbers. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the BILL steps come from BILL's own help articles, linked below, which we read on October 20, 2026. BILL's main help center at help.bill.com only loads in a full web browser, so our automated reader couldn't open its MFA article there, which BILL updated on October 15, 2026. We read the version BILL publishes on vendorpayhelp.bill.com, the help center it runs for American Express Vendor Pay, last updated January 30, 2026. We haven't tested the steps on a BILL account, so a label may differ slightly, and the newer article may add details this guide doesn't cover. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

When BILL first asks you to set up 2-step verification, you can choose Use an Authenticator app right there. To add it later (BILL):

1. Sign in to BILL at app.bill.com/Login (BILL).
2. Select Settings, then Security under User Settings, then Enroll authenticator. Adding a method asks for a code even on a trusted device, so keep your current method at hand.
3. BILL asks which authenticator app you use. Its article doesn't list the choices.
4. BILL shows a barcode. In Novaz, tap +, then Scan QR code. If BILL is open on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
5. Type the first code from Novaz into BILL and select Submit.
6. Save your recovery codes (below).

BILL's article only describes scanning the barcode and doesn't mention a text key you could type instead. Afterwards, BILL lets you choose between your phone number and the app whenever it asks for a code.

Save the recovery codes

An authenticator app comes with recovery codes. Each works once and stands in for your phone or app if you lose them. The sample screen in BILL's article, Your recovery codes, shows ten codes with Download, Copy and Print buttons, and warns that you can't view them again after you leave it (BILL). So save them before you select Finish. If you lose the iPhone with no Novaz backup, or with a backup file made before you added BILL, these codes are your way back in. BILL doesn't say how to get a new set. See 2FA backup codes.

When BILL asks for a code

At sign-in. Trust this device for 180 days spares you the prompt on that device for 180 days; leave it unticked on a shared or public computer. Even a trusted device gets asked when you change your password or phone number, add or remove a 2-step verification method, or add a bank account (BILL).

Asked too often despite trusting the device? BILL suggests allowing its site in any ad or site blocker, then removing your trusted devices under Settings > Security (this part of the article says under You, not User Settings) with Remove next to each one under Trusted Devices, and trusting the device again at your next sign-in.

If BILL rejects your code

BILL's troubleshooting covers texted and called codes only. For app codes, check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. More in Authenticator code not working? If your account also has a phone number, you can pick that at the prompt instead.

New iPhone or no more app

BILL doesn't document moving the authenticator. Its tools are Remove authenticator and Enroll authenticator under Settings > Security, and both ask for a code, so switch while the old iPhone still works. You can't turn 2-step verification off altogether: remove every method and BILL makes you set up a new one at the next prompt (BILL). With Novaz's iCloud backup or a backup file, you can restore BILL on the new iPhone instead of enrolling again; see How to transfer your authenticator app to a new iPhone. Once BILL no longer uses the app, open BILL in Novaz and tap Remove account.

If you lose your authenticator

Sign in with a recovery code, or a text or call if your account has a phone number, then remove the old authenticator and enroll it again. If you can't get phone codes either and can't change the number, BILL points to its 2-step Verification Access Request form (BILL, BILL). That form only loads in a full browser, and the articles we read don't say what it asks for, how long a reset takes, or what to do about a lost app specifically. See Lost the phone with your authenticator app?

Official BILL help

• Multi-factor authentication (MFA)/2-step verification
• Can't log in to BILL
• Change or reset your password
• 2-step Verification Access Request form
• BILL's main help center article on MFA (loads only in a full web browser; we couldn't read it)