M1 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Your M1 account is where you invest and move money, so it deserves more than a password. Two-factor authentication (2FA) is optional at M1, and there's only one kind: codes from an authenticator app. M1 doesn't send sign-in codes by text or email (M1). The catch is recovery: M1's help mentions no backup codes and tells you to keep the setup key instead. This guide uses Authenticator App - Novaz on iPhone, but any authenticator app works the same way.
How we checked this guide: the M1 steps come from M1's own help center, linked below, which we read on October 21, 2026. We haven't tested them on an M1 account, so a label may differ slightly. M1 marks these help articles as written with the help of AI, which is one more reason to expect small differences from what you see. The Novaz steps are checked against the app, version 1.0.5.
Before you start: plan to save the setup key
M1's backup advice is to store the M1 setup key somewhere safe when you enroll, so you can add M1 to a new device later (M1). A Novaz iCloud backup or backup file can restore M1 on a new iPhone, but M1's advice is about the key itself, so copy it from M1's setup screen yourself, into a password manager or onto paper, before you finish.
Turn on 2FA with an authenticator app
M1's help describes these steps for the website (M1):
- Log in to M1 and open your account Settings.
- Go to the Security section.
- Click Turn On Two-Factor Authentication.
- M1 shows a QR code and a setup key. Write the setup key down now, as above.
- In Novaz, tap +, then Scan QR code, and point the camera at the code. If the code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- If scanning doesn't work, tap +, then Enter key manually. Type "M1" as the Service, your email as the Account if you like, and the key as the Setup key. See What is a 2FA setup key?
- Type the code Novaz shows into M1 to confirm and finish.
M1 says its codes change every 30 seconds, which matches what Novaz uses for a typed key.
When M1 asks for a code
Once 2FA is on, M1 asks for your password and an authenticator code at every login (M1). Sign-in runs through a secure Auth0 login window (M1).
Separately, M1 has adaptive multi-factor authentication. If it sees something unusual, it can email you a 6-digit passcode to enter at the login screen (M1). That email code isn't your authenticator code, so check which one the screen asks for.
If M1 rejects your code
M1's own checklist (M1):
- Make sure your phone sets its date and time automatically. On iPhone: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
- Don't type a code that has already expired, and check for digits you might have misread.
- If you switched devices or deleted your authenticator, enter the setup key again.
- If the trouble is during setup, try turning off ad blockers or privacy tools.
More causes are in Authenticator code not working?
Changing phones
M1's help doesn't describe moving 2FA to a new phone from inside your account. The documented route is the setup key you saved: add it to the authenticator on the new phone (M1). In Novaz, that's +, then Enter key manually. A Novaz iCloud backup or backup file works too: restore it on the new iPhone and M1 comes with it. Without either, you'll need M1's reset (below). See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
If you saved the setup key, add it to an authenticator on any phone and sign in as usual.
If you didn't, you need M1 to reset 2FA. On the login screen, look for the option for trouble with 2FA, such as "Can't access authenticator," and follow the recovery steps (M1). You can also contact M1 Client Success. Either way, M1 asks for a photo of a valid government-issued ID and a selfie. Once it has verified you, it resets or turns off 2FA so you can set up a new app (M1). M1 doesn't say how long this takes.
Client Success works on days the U.S. stock market is open. For login help, the email address is login-help@m1.com. For urgent requests you can call 312-600-2883, Monday to Friday, 9:00am to 4:00pm ET (M1).
A forgotten password is a separate problem: M1 says you can reset it without turning off 2FA. See Lost the phone with your authenticator app? for general steps.
Turning 2FA off
On the web, go to Settings > Security and switch Two-Factor Authentication off. In the mobile app, open Settings, tap Enable 2 Factor Authentication to reach the toggle, and switch it off. If you can't log in, M1 points you to a 2FA request form in its Client Center, with the same ID and selfie check (M1). Once 2FA is off, open M1 in Novaz and tap Remove account.
M1 urges you to keep 2FA on, above all if your password has leaked from another site (M1).
