Plutus 2FA: how to set up an authenticator app
By the Novaz team · Updated October 29, 2026
Novaz steps checked against version 1.0.5
On this page
Plutus is a UK-founded crypto neobank whose main product is a rewards debit card (Plutus). Its help pages describe two separate kinds of protection. On the web, you can add two-factor authentication (2FA) with an authenticator app. In the Plutus mobile app, the extra layer is Biometric Security and a PIN instead (Plutus). Plutus recommends 2FA but doesn't say it's required for anything. This guide covers the web setting, with Authenticator App - Novaz on iPhone as the code app. Any authenticator app works the same way.
How we checked this guide: the Plutus steps come from Plutus's own help centre and blog at plutus.it, linked below, which we read on October 24, 2026. We haven't tested them on a Plutus account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.
Which apps Plutus supports
Plutus's help names two: it recommends Authy, and says Google Authenticator also works with its service (Plutus). Both are standard time-based code apps, so other apps of that kind, Novaz included, should work too. Plutus doesn't mention SMS codes as an option.
Turn on 2FA with an authenticator app
Plutus's instructions are short. Its help gives this path for the web account (Plutus):
- Sign in to Plutus on the web. The help centre's Log in link takes you there.
- Open your Profile, then Settings, then Security.
- Turn on 2FA there and follow the steps Plutus shows.
- When Plutus shows a QR code, open Novaz, tap +, then Scan QR code, and point the camera at it. If the code is on the same iPhone, take a screenshot and use Choose a photo instead. See scanning a QR code on the same iPhone.
- Type the current code from Novaz into Plutus to finish.
Plutus's help doesn't describe the screens in more detail. It doesn't say whether a text key is offered in place of the QR code, or how often the codes change. If you do get a key, in Novaz tap +, then Enter key manually, and put it in Setup key. Scanning is the safer choice, since a QR code carries the code settings and a typed key always gets 30-second, 6-digit codes. More in What is a 2FA setup key?
The mobile app is a different story. There, Plutus points you to Profile > Settings to turn on Biometric Security (Plutus). That relies on your phone's biometric unlock and a PIN, not an authenticator app.
No backup codes in the docs
Plutus's help doesn't mention backup or recovery codes. If your phone is lost and you have no Novaz backup to restore, Plutus Support is the documented way back in. Make sure you can still get into the email address on your Plutus account. Plutus calls your email the gateway to the account (Plutus).
Plutus also says its staff will never ask you for your password or 2FA codes. Anyone who does isn't Plutus.
If Plutus says your code has expired
Plutus's help describes this exact problem: codes rejected as "expired" however fast you type them. It blames the app getting out of sync with your account and suggests these fixes (Plutus):
- Wait for the current code to run out, then type the next one as soon as it appears.
- Set your phone's time correctly. On iPhone, go to Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off.
- Its other two tips, reinstalling Authy or trying Google Authenticator, are for Authy users.
If none of that helps, see Authenticator code not working?
Changing phones
Plutus's way to change your authenticator is to turn 2FA off in the web settings while you still have it, then turn it on again (Plutus). Do that with the old phone in hand, and scan the new QR code into Novaz on the new iPhone. You can skip this if you restore Novaz on the new iPhone from iCloud backup or a backup file. See How to transfer your authenticator app to a new iPhone.
If you lose your authenticator
For the web account, Plutus says to contact Support, which will disable 2FA for you (Plutus). The help centre gives support@plutus.it as its contact address (Plutus). Plutus doesn't say what proof of identity it asks for or how long the reset takes.
For the mobile app, the fix is different: Plutus says the PIN and Biometric Security live in the app itself, so reinstalling the app resets them. If you're also locked out after too many wrong passwords, Plutus sends an email with instructions (Plutus).
More in Lost the phone with your authenticator app?
Turning 2FA off
If you still have your codes, disable 2FA in the same web settings. When you remove it, also delete the Plutus entry in Novaz: open it and tap Remove account.
