Hatch 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Hatch is the New Zealand investing platform you sign in to at app.hatchinvest.nz to manage your shares and money. Two-factor authentication (2FA) isn't optional there. New customers have to set it up before they can open an investment account, and once it's on, Hatch's help says plainly: "You won't be able to turn 2FA off" (Hatch). What you can change is the method. Hatch offers an authenticator app, an SMS code to a New Zealand mobile number, or an automated phone call to a New Zealand number, and it recommends the app as the most secure choice.
This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.
How we checked this guide: the Hatch steps come from Hatch's own help center, linked below, which we read on October 24, 2026. We haven't tested them on a Hatch account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Turn on 2FA with an authenticator app
New customers are asked to choose a method right after they first sign in. If you're an existing customer, or you want to switch to an app, start from settings (Hatch, Hatch):
- Sign in to Hatch and go to Settings.
- Click Two factor authentication. One older page also mentions a Start Setup button at this point.
- Choose Authenticator app. Hatch then shows a QR code.
- In Novaz, tap +, then Scan QR code, and point the camera at the code. If Hatch is open on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If you can't scan it, click Can't scan? Set up manually. Hatch shows a 32-character setup key. In Novaz, tap +, then Enter key manually, type a name such as Hatch in Service, and paste the key into Setup key. See What is a 2FA setup key?
- Type the 6-digit code from Novaz into the box under the QR code and click Turn on two-factor authentication.
Hatch's pages word the settings entry differently, so labels may vary.
One detail is unclear. Hatch's troubleshooting tips say its codes refresh every minute, while a key typed by hand into Novaz always gets 30-second codes. Scanning the QR code is the safer route, because the code carries the settings Hatch actually uses. You can check what Novaz picked by tapping the account and looking at Interval under Details.
If you had Hatch in an authenticator app before, Hatch suggests deleting that old entry first. In Novaz, open it and tap Remove account.
Save your backup codes and add a recovery method
After setup, Hatch gives you backup codes and strongly recommends printing them or storing them away from the device that holds your authenticator. Each code works once. Making a new set from your 2FA settings cancels all the old ones (Hatch).
Hatch also lets you add a second 2FA method, which it calls a recovery method, alongside your default one, and suggests one that doesn't depend on your phone (Hatch). Novaz keys stay on your iPhone unless you turn on iCloud backup or export a backup file, so if you lose the phone without one, your backup codes and any recovery method are what get you back in. More in 2FA backup codes.
When Hatch asks for a code
Once 2FA is on, Hatch asks for a code every time you sign in, after your email and password. Open Novaz and type the 6-digit code shown for Hatch (Hatch).
If Hatch rejects your code
Hatch's own tips: each code can be used only once, so wait for a fresh one rather than retrying the same code, and make sure it hasn't expired. Authenticator apps also need the correct time (Hatch). On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?
Changing phones
Hatch's help doesn't describe a phone move as such. What it does describe is switching your default 2FA method from settings and resetting the old one. With a Novaz iCloud backup or backup file, you can restore your accounts on the new iPhone. Without one, while you still have the old phone, sign in and set up the authenticator again on the new one. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
Sign in with your email and password, then on the code screen click Use your recovery method and enter one of your backup codes. Once you're in, Hatch says to change your default 2FA method and remove the old one as soon as possible, which may take another backup code (Hatch).
If you have no backup codes and no recovery method you can reach, Hatch says to contact Hatch for help getting back into the account. Its help doesn't say what proof it asks for or how long it takes. See Lost the phone with your authenticator app?
