Questrade 2FA: how to set up an authenticator app

Questrade is a Canadian online broker. Its two-factor system is called 2-step verification. You can already get those codes by text message or phone call, and Questrade has replaced email codes with Push Approval in its own apps (Questrade). An authenticator app is the other choice, and it's the only one that keeps working once you switch off text messages. This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Questrade steps come from Questrade's own Learning Centre articles, linked below. Questrade's site blocked our automated reader, so on October 21, 2026 we read the articles as archived copies on web.archive.org, saved on August 30, 2026. We haven't tested the steps on a Questrade account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Scan the QR code, don't type the key

Questrade's article says the key shown next to its QR code is 15 characters long (Questrade). Typing a key into Novaz by hand needs at least 16 characters, so a 15-character key may be turned away. Scanning the QR code avoids the problem.

Turn on 2FA with an authenticator app

Questrade's Mobile and Desktop Authenticators article, updated July 22, 2026, gives these steps (Questrade):

1. Log in to Questrade on the web.
2. Click your profile at the top right, then Settings.
3. In the Security section, click Edit.
4. Click Set up next to Authenticator app.
5. Questrade shows 10 recovery codes before it shows the QR code. Save them somewhere safe away from your phone, then click Continue.
6. In Novaz, tap +, then Scan QR code, and point the camera at the QR code. On the same iPhone, take a screenshot, tap +, then Choose a photo. See scanning a QR code on the same iPhone.
7. Type the 6-digit code from Novaz at the bottom of the page and click Submit.

The text key below the QR code is labeled Key. For background, see What is a 2FA setup key?

Questrade's Account security centre page describes the setup with a Manage button and a toggle instead (Questrade). The labels on your screen may follow either version.

When Questrade asks for a code

By default, Questrade asks for 2-step verification when you log in from a device it doesn't know, or when it sees unusual network activity. If you turn on Added security (through Manage on the Settings page), it asks at every login (Questrade). Devices you've used are listed under Settings > My trusted devices, and those get fewer prompts (Questrade).

At the prompt, select Authenticator app, click Continue, and type the code from Novaz. Questrade Edge Desktop uses the same prompt and lists the authenticator first.

Turning off text-message codes

After the authenticator app is set up, Questrade leaves text messages and phone calls on as well. You can switch off SMS from the same page, but only once an authenticator is in place, because at least one method always has to stay on. If you later remove the authenticator, Questrade turns SMS back on by itself (Questrade). If you're weighing the two, see authenticator app vs. SMS.

Your recovery codes

Each of the 10 codes signs you in once, through the Use recovery code link at the 2-step verification prompt. You can make a fresh set from Settings > Authenticator app, and the old set stops working at that moment. (The article also mentions "all five" codes in one sentence; every other line says 10.) Questrade suggests keeping them offline, or in a secure password manager if they must be stored online (Questrade).

Unless you've turned on iCloud backup or exported a backup file in Novaz, its keys exist only on your iPhone, so these codes are what gets you back in if it's lost. Keep them even with a Novaz backup, in case the backup is older than your Questrade account. More in 2FA backup codes.

If Questrade rejects your code

Questrade's own tips are to wait for a fresh code if the current one is about to run out, since codes change every 30 seconds, and, if codes are rejected after setup, to delete the entry and add it again. Also check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when the clock is 15 seconds or more off. More causes are in Authenticator code not working?

Changing phones

Questrade doesn't describe a phone-to-phone transfer. With Novaz you can bring your accounts across yourself: restore from iCloud backup on the new iPhone, or use Import from file… with a backup file. Without a Novaz backup, plan to set Questrade up again on the new phone while you can still log in on the old one. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

Use a recovery code at the login prompt. If you kept text-message codes on, those still work too. If you've lost both the phone and the recovery codes, call Questrade at 1.888.783.7866 or use live chat. Questrade says restoring access in that case can take up to 48 hours (Questrade). It doesn't list what proof it asks for. More in Lost the phone with your authenticator app?

Official Questrade help

All read as archived copies on web.archive.org, saved on August 30, 2026.

• Mobile and Desktop Authenticators (updated July 22, 2026)
• Account security centre (updated August 14, 2026)
• Security Update - We are discontinuing email verification (updated May 13, 2026)