myki 2FA: how to set up an authenticator app for your myki account

Your myki account holds the myki cards you use on Victorian public transport, with their top-ups and refunds. You reach it in the PTV app or on the Transport Victoria website, where ptv.vic.gov.au now forwards. Multi-factor authentication (MFA) is switched on for every myki account, so this isn't a setting you choose to turn on. What you can choose is how you get the codes (Transport Victoria).

Text message is the default, and you can only move to an authenticator app after verifying your mobile number by SMS. The setup shows a code to type, not a QR code. This guide uses Authenticator App - Novaz on iPhone for the app side. Any authenticator app that makes 6-digit codes works the same way.

How we checked this guide: the myki steps come from Transport Victoria's own PTV App help pages, linked below, which we read on October 24, 2026. The website blocks automated requests, so we read its pages in archived copies on web.archive.org; the newest copy of the MFA page is from December 2025. We haven't tested the steps on a myki account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

When myki asks for a code

Your username and password still get you into the account. The second check comes later: Transport Victoria says you'll be asked to verify each time you open your myki account settings, and before some actions, such as changing your personal details or asking for a refund (Transport Victoria).

First: verify your mobile number

If you haven't done this yet, myki prompts you the next time you sign in, in the PTV app or through log in to myki on the website (Transport Victoria):

1. On the mobile verification screen, enter your mobile number and tap Send code.
2. Type the 6-digit code from the text message and tap Verify code. The code expires after 5 minutes.
3. When you see that mobile verification is complete, tap Done.

If you have no mobile number, see the contact details in the last section.

Switch to an authenticator app

Transport Victoria lists these steps, with labels in lowercase, so the buttons may look slightly different (Transport Victoria):

1. Log in to your myki account.
2. Go to my account.
3. Select change verification method.
4. Pass the SMS check with the code sent to your phone.
5. Select authenticator app.
6. Tap I have installed an authenticator app. myki then shows a code that its help page calls a 20-digit code. This is your setup key. The page mentions no QR code.
7. In Novaz, tap +, then Enter key manually. Type myki as the Service, add your username as the Account if you like (it's optional), and paste or type the code as the Setup key. See What is a 2FA setup key?
8. Back in your myki account, enter the 6-digit code that Novaz now shows in the box, then tap Done.

Transport Victoria warns that some authenticator apps make 8-digit codes, which are "not compatible with PTV". Novaz makes 6-digit codes from a typed key, so that's fine. The help page doesn't say how often the codes change; a key typed into Novaz gets the usual 30 seconds.

No backup codes

The help pages don't mention backup or recovery codes for myki, and they don't say whether you can still get a text message once you've chosen the app. Keep your mobile number on the account up to date, since SMS is how you switch methods back.

If myki rejects your code

Transport Victoria's pages don't cover rejected codes. The usual cause is the phone's clock: on your iPhone, open Settings > General > Date & Time and turn on Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Before you change phones or delete the app

Transport Victoria says never to delete or uninstall your authenticator app while your account is active, or you could lose access to parts of it. Change your verification method back to SMS first, then pair the app again on the new device (Transport Victoria).

If you restore Novaz on the new iPhone from iCloud backup or a backup file, myki's codes come with it. Without a backup, the order is: switch myki to SMS while your old iPhone still works, set up the new iPhone, then pick authenticator app again and pair Novaz on it. To remove myki from Novaz afterwards, open it and tap Remove account. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

The myki help doesn't describe a recovery route for a lost authenticator app. The help it does give is for people without a mobile number, or without access to the number on their account: call Transport Victoria on 1800 800 007, from 6am to midnight daily and all night on Friday and Saturday, or go to the PTV Hub at Southern Cross Station (Transport Victoria). That's the place to start if you've lost the phone with Novaz on it too. The page doesn't say what proof you'll need or how long it takes.

A forgotten password is a separate problem: the PTV app's Forgot password screen asks for your username and security answers, then emails a temporary password (Transport Victoria). More in Lost the phone with your authenticator app?

Turning it off

MFA is on for all myki accounts, and the help pages describe no way to switch it off. What you can change is the method: change verification method takes you back to SMS.

Official Transport Victoria help

• Set up multi-factor authentication for myki in the PTV App
• myki account login options in the PTV app
• Forgotten myki username or password in the PTV App