Morgan Stanley Online 2FA: how to set up an authenticator app

Morgan Stanley Online is where Morgan Stanley Wealth Management clients manage their accounts. Two-step verification is already on: by default, you get a code by text message or phone call. The other methods are a prompt in the Morgan Stanley app, a security key, or an authenticator app (Morgan Stanley), which Morgan Stanley says adds protection against SIM swapping (Morgan Stanley). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Morgan Stanley steps come from Morgan Stanley's own client guides and Security Center pages, linked below, which we read on October 19, 2026. We haven't tested them on a Morgan Stanley Online account, so a label may differ slightly. The authenticator guide dates from 2023, but a 2026 overview uses the same menus. The Novaz steps are checked against the app, version 1.0.5.

Before you switch: enroll in VoiceID

VoiceID is Morgan Stanley's voiceprint check for phone calls. The Client Service Center can only help with login problems once you're enrolled, and lifts a lost-phone lock only if VoiceID has been active for 30 days (Morgan Stanley). Call 800-869-3326 to enroll (Morgan Stanley).

Registering the app on one of your Morgan Stanley Online usernames registers all of them.

Turn on 2FA with an authenticator app

Use a computer if you can (Morgan Stanley):

1. Sign in to Morgan Stanley Online. Select the Services tab, then Security Center.
2. Find Two-step verification and click Edit.
3. Choose Authenticator app and click Continue.
4. On Authenticator app registration, a QR code appears. In Novaz, tap +, then Scan QR code. If the code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
5. Can't scan it? Below the QR code is a key and a Copy key to clipboard link; spaces aren't required. In Novaz, tap +, then Enter key manually, and paste it as the Setup key. Scanning is safer, since Morgan Stanley doesn't say how often codes change. See What is a 2FA setup key?
6. Click Continue. On Finalize registration, enter the 6-digit code from Novaz and click Continue.
7. Save the backup code Morgan Stanley shows you.
8. Choose whether to add a backup verification method, and click Continue.
9. Name the authenticator app, click Continue, then Done.

In the Mobile App, open Security Center from the menu and do steps 2 and 3. If it detects an authenticator app, it offers Use my authenticator app; otherwise it shows a key to add in Novaz with Enter key manually. Then do steps 6 to 9.

The backup code

Morgan Stanley gives you one backup code and doesn't say whether it's reusable or how to replace it. If you haven't made a Novaz backup (iCloud backup or a backup file), its keys exist only on that iPhone, and this code and any backup method from step 8 are your way in without it. Store the code in a password manager or on paper. See 2FA backup codes.

When Morgan Stanley asks for a code

By default, only when you sign in on a device or browser you haven't saved. After verifying, you can Save this device, but only on your own devices. To verify at every sign-in, turn on Verify your identity at every login under Two-step verification > Edit (Morgan Stanley).

Enter the Novaz code on Authorize your session and click Authorize. Morgan Stanley says it never calls or texts to ask for a one-time passcode (Morgan Stanley), so don't read a code to a caller.

If Morgan Stanley rejects your code

Morgan Stanley's guides don't cover rejected codes. Check your iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. Other causes are in Authenticator code not working?

If you lose your authenticator

The code screen offers Use your authenticator backup code, Use an alternative method and Report a lost device with your authenticator app. If another device has a registered authenticator app, sign in with it and remove the lost phone's app in your authenticator app settings (Morgan Stanley).

Reporting a lost device, there or at the Client Service Center (888-454-3965), locks your accounts temporarily. The center can lift it after verifying you, if VoiceID has been active for 30 days. International clients contact their Client Representative instead (Morgan Stanley). Morgan Stanley doesn't say what happens without VoiceID or how long unlocking takes. More in Lost the phone with your authenticator app?

Changing phones

If you turned on iCloud backup or exported a backup file in Novaz, restore your accounts on the new iPhone and the Morgan Stanley codes keep working. Without a backup, you'll add Morgan Stanley again on the new one. See How to transfer your authenticator app to a new iPhone. Morgan Stanley gives no steps for this, so start at Two-step verification > Edit while the old iPhone still works.

Switching back to text codes

Morgan Stanley doesn't describe turning two-step verification off, only changing the method: go to Two-step verification > Edit, pick another method such as Text/voice security code, and click Continue (Morgan Stanley). Once it works, open Morgan Stanley in Novaz and tap Remove account.

Official Morgan Stanley help

• How to Use Authenticator Apps with Morgan Stanley Online (PDF, July 2023)
• What Is Multi-Factor Authentication? (PDF, July 2026)
• Cybersecurity Tips & Fraud Protection (Security Center)
• Dealing with Cyber Threats: The Evolution of Multi-Factor Authentication