Skip to content
Novaz AuthenticatorGET

Deutsche Bahn 2FA: how to set up an authenticator app for your DB account

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. Create your backup codes right away
  3. When DB asks for a code
  4. If DB rejects your code
  5. Changing phones
  6. If you lose your authenticator
  7. Turning 2FA off
  8. Official Deutsche Bahn help

Your DB Kundenkonto is the Deutsche Bahn account you use on bahn.de and in the DB Navigator app. Before you turn on two-factor authentication (2FA) for it, know one thing: if you lose your second factor and have no backup codes, Deutsche Bahn says it can't reset it for you. Your only option then is a new account with a different email address (Deutsche Bahn).

2FA is optional for the DB Kundenkonto, though Deutsche Bahn recommends it, mainly as protection against phishing (Deutsche Bahn). You choose between an authenticator app and SMS codes (SMS-Tan). This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.

How we checked this guide: the Deutsche Bahn steps come from Deutsche Bahn's own help pages on bahn.de, linked below, which we read on October 21, 2026. We haven't tested them on a DB account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5. The help is in German only, so the labels below are German, translated where it helps.

Turn on 2FA with an authenticator app

Deutsche Bahn's help describes the start of the setup (Deutsche Bahn):

  1. Sign in to your DB Kundenkonto on bahn.de.
  2. Open the account manager under Login & Sicherheit (Login and security).
  3. Choose Authenticator App as your method rather than SMS-Tan.
  4. Follow the instructions on screen. In Novaz, tap +, then Scan QR code, and point the camera at the QR code. If it's on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
  5. If you can't scan the code and the page shows a key instead, tap +, then Enter key manually in Novaz, and type it as the Setup key. See What is a 2FA setup key?
  6. Type the code Novaz shows when the page asks for it.

The help doesn't describe the setup screen itself, so it doesn't say whether you get a QR code, a text key or both. If there's a QR code, scan it: it carries the code settings to your app.

If DB won't accept your phone's country code when you try SMS-Tan, its help points you to the authenticator app instead (Deutsche Bahn).

Create your backup codes right away

Deutsche Bahn calls backup codes Ersatzcodes. Its help doesn't say they're created during setup, so make them yourself straight after (Deutsche Bahn):

  • On bahn.de: sign in, open the account manager under Login & Sicherheit, click 2-Faktor-Authentifizierung, then Ersatzcodes aktivieren.
  • In DB Navigator: sign in, go to Profil, open the Login & Sicherheit area, choose 2-Faktor-Authentifizierung and tap Ersatzcodes aktivieren.

Print, download or copy the codes before you leave the page. Once you sign out, DB no longer shows them in your account. Each code works once. You can make a new set at any time, and the old set stops working when you do (Deutsche Bahn).

Unless you've backed up Novaz with iCloud backup or a backup file, its keys live only on that iPhone, and these codes are your fallback if the phone is gone. Keep them on paper or in a password manager. More in 2FA backup codes.

When DB asks for a code

DB asks for the second factor when you sign in. At that step you can pause the prompt on that device for a set period, which saves it as a trusted device; afterwards, DB asks again. Don't do this on public or shared devices, DB says (Deutsche Bahn).

If a trusted device is lost or stolen, remove it: under Login & Sicherheit, choose 2-Faktor-Authentifizierung and take it off the list of trusted devices. DB also advises changing your password, which signs you out of bahn.de, DB Navigator and other DB apps everywhere (Deutsche Bahn).

If DB rejects your code

Deutsche Bahn's help doesn't cover rejected authenticator codes. The usual cause is the iPhone's clock: open Settings > General > Date & Time and turn on Set Automatically. Novaz also warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

Changing phones

DB's help doesn't describe moving the authenticator to a new phone. If you use Novaz's iCloud backup or a backup file, restore your accounts on the new iPhone and DB's codes keep working. Without one, use the steps DB does document: while you still have the old phone, turn 2FA off, set it up again with the new phone, and make new Ersatzcodes. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Use a backup code. Sign in with your email address and password, choose Kein Zugang zum zweiten Faktor? (No access to the second factor?) at the verification step, pick Ersatzcode, and type one of your codes (Deutsche Bahn).

Without a backup code, there's no way back in. Deutsche Bahn says it can't reset the second factor, and customer service can't delete the account by hand. You'd need a new DB Kundenkonto with another email address; the old one is deleted after a period of inactivity. If you need a ticket urgently, DB suggests booking without signing in (Deutsche Bahn).

More general steps are in Lost the phone with your authenticator app?

Turning 2FA off

Sign in with your username and password, open the account manager under Login & Sicherheit, and follow the instructions there to turn off 2FA (Deutsche Bahn). Then, in Novaz, open the DB entry and tap Remove account.

Official Deutsche Bahn help

More guides: Travel and transport