Skip to content
Novaz AuthenticatorGET

Mercury 2FA: how to set up an authenticator app

By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5

On this page
  1. Turn on 2FA with an authenticator app
  2. Keep your backup codes
  3. When Mercury asks for a code
  4. If Mercury rejects your code
  5. Changing phones
  6. If you lose your authenticator
  7. Turning 2FA off
  8. Official Mercury help

Many US startups run their business banking on Mercury, and there two-factor authentication (2FA) is required on every account. Codes never come by text message, and everyone sets up at least one authenticator app, even if they later sign in with a passkey or security key (Mercury, Mercury). Mercury recommends its own mobile app for the codes, but third-party apps work too. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Mercury steps come from Mercury's own help center and website, linked below, which we read on October 19, 2026. We haven't tested them on a Mercury account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

You meet this step early: Mercury asks for 2FA right after you submit your application, and new users get a Set-up two-factor authentication step in their new user checklist on the desktop site (Mercury, Mercury). For a third-party app:

  1. Sign in to Mercury on a computer and follow the setup until it shows a QR code.
  2. In Novaz, tap +, then Scan QR code, and point the camera at the screen. If the QR code is on your iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
  3. Type the 6-digit code from Novaz into the setup flow on the computer.

Mercury's help only describes scanning and doesn't mention a text key, so plan to scan. That also settles a small inconsistency: the help center says codes refresh every 30 seconds, while a 2022 Mercury blog post says 60 (Mercury, Mercury). The QR code tells Novaz the right interval. To see it, tap the Mercury entry and look at Interval under Details.

Keep your backup codes

Backup codes get you in when your authenticator can't, and Mercury's first choice for storing them is a password manager. To replace used or lost ones, go to Settings > Security and click Generate Codes (Mercury).

Novaz's keys stay on your iPhone unless you turn on iCloud backup or export a backup file, so keep these codes either way. See 2FA backup codes. Mercury also suggests a passkey on a second device, so losing one phone doesn't lock you out (Mercury).

When Mercury asks for a code

You'll need one when you sign in with your password after a period of inactivity, or on a new device or browser (Mercury). Mercury's passkey article mentions a Trust this device for 30 days box on the 2FA screen, and a passkey sign-in skips both password and code (Mercury).

Large payments are separate. Mercury is rolling out optional multi-device authentication, which asks you to approve risky actions such as big payments in the Mercury mobile app (Mercury). Novaz only makes codes, so those approvals need Mercury's app.

If Mercury rejects your code

Mercury's help names one trap. After 2FA is reset on your profile, the key behind the codes changes, so the old entry in your app shows codes that no longer work (Mercury). In Novaz, open the old Mercury entry, tap Remove account, and add the new one.

Otherwise, check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More in Authenticator code not working?

Changing phones

Do this while you still have the old iPhone. In Mercury, open Settings > Security, find Two-factor authentication, click Reset in the 2FA app row, and set up the new phone. Mercury may ask for a fresh code if you haven't used one in 30 minutes (Mercury). The setup article calls the page Profile > Security, so labels may differ. With a Novaz iCloud backup or backup file, you can restore the account on the new iPhone instead of resetting. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Go to app.mercury.com/login, enter your email and password, and on the Verify login screen click Reset two-factor authentication (a screenshot shows it as Reset 2-factor authentication). Enter a backup code, or click Backup codes lost? (Mercury). Then:

  • Business owners and account holders: another admin on the account approves. With no other admin, you record a video, by webcam or phone, showing your ID and reading a script, and Mercury's team reviews it.
  • Team members: an admin on the account approves.

On Mercury Personal, account holders always do the video (Mercury).

Once approved, you get an email titled Your reset request has been approved. Its link, valid for 14 days, takes you to sign in and finish the reset. Mercury doesn't say how long the review takes. A passkey can also get you in, and the last resort is help@mercury.com (Mercury, Mercury). More in Lost the phone with your authenticator app?

Turning 2FA off

You can't: Mercury requires it (Mercury). Its help is also inconsistent about dropping the authenticator app: the setup article requires at least one, while the passkey article says a security key plus backup codes is enough (Mercury).

Official Mercury help

More guides: Banks and credit unions