British Airways 2FA: how to set up an authenticator app

Your British Airways account is your membership of The British Airways Club, the programme for Avios and tier points that BA called the Executive Club until April 1, 2025 (British Airways). You sign in with it on ba.com and on avios.com (Avios). Two-factor authentication, which these pages call multi-factor authentication (MFA), has no switch to turn on. It starts when a sign-in triggers a security check. You can then pick an authenticator app, a text message (SMS), or face or fingerprint recognition (Avios). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the British Airways steps come from the Avios help centre and BA's own help pages, linked below, which we read on October 20, 2026. Both sites block automated reading, so we read archived copies on web.archive.org: the Avios help centre saved October 13, 2026, BA's Help page saved October 7, 2026, BA's FAQs saved June 14, 2026, and the Club terms saved July 10, 2026. BA's Help page sends account problems to its Log in help page (British Airways), which has no archived copy, so nothing here comes from it. We haven't tested the steps on a British Airways account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Why the steps come from Avios

The setup steps are in the Authenticator apps (MFA) section of the Avios help centre. Avios isn't a third party: the Club terms make Avios Group (AGL), a BA Group company, a party to every member's contract (British Airways). BA's own FAQs give the same WhatsApp reset that Avios describes (British Airways).

When British Airways asks for MFA

Avios says you won't complete MFA at every sign-in, only when a security check calls for it. When it does, you can't skip it or turn it off: "MFA is mandatory when prompted" (Avios). Neither site describes a setting in your profile, or any other way to start the setup yourself.

Set up the authenticator app

When a sign-in prompts you, you get an email with setup instructions. Avios lists these steps (Avios):

1. Open the email and select Set up two-factor authentication.
2. Follow the instructions and choose an authenticator app. The other choice is SMS.
3. Add the account to Novaz (below).
4. Keep the recovery code you're given somewhere safe.
5. If face or fingerprint recognition is offered, you can register it too.
6. Go back to the MFA screen, continue, and complete MFA with your new method when asked.

Avios names Google, Microsoft, Authy and Duo as example apps (Avios). Neither site shows the setup screen or says whether you'll get a QR code, a text key or both, or how many digits the codes have. In Novaz:

• QR code: tap +, then Scan QR code, and point the camera at it. If the code is on the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
• Text key: tap +, then Enter key manually, and fill in Service, Account (optional) and Setup key. See What is a 2FA setup key?

Scan the QR code if there is one. It tells Novaz the code settings, while a typed key always gets 6-digit codes every 30 seconds.

Keep the recovery code

Avios says you'll need the recovery code if you change the contact details registered for MFA. Updating your phone number or email in your account doesn't update MFA, which has to be reset and set up again on its own (Avios). The pages don't say whether the code can also get you in when you lose your phone, whether it works more than once, or how to get a new one.

Unless you back Novaz up (iCloud backup or Export to file… under Settings > Backup), its keys live only on your iPhone, so store this code in a password manager or on paper, away from the phone. See 2FA backup codes.

Signing in with your code

Avios points out that an authenticator app's code doesn't pop up on your screen. When sign-in asks for a one-time code, open the app and type the current code (Avios).

If British Airways rejects your code

The official pages don't cover rejected codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

Avios says your chosen method works across multiple devices, but not how to add an authenticator app on a second phone. For a new phone number or a lost MFA device, it points to an MFA reset over WhatsApp. A reset removes all your MFA methods, and you set one up again when a sign-in next asks (Avios).

With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone and skip the reset. Without one, plan on a reset and a fresh setup, and keep the old iPhone until it's done. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

1. Use the WhatsApp link in BA's FAQs to ask for an MFA reset (British Airways).
2. Set MFA up again on your new phone when a sign-in next asks for it (Avios).

Neither site says what proof of identity a reset needs or how long it takes. More in Lost the phone with your authenticator app?

Official British Airways and Avios help

• Avios help centre & FAQs (see Authenticator apps (MFA))
• Frequently asked questions (British Airways)
• Help | Information | British Airways
• Terms and Conditions | The British Airways Club | British Airways