Service Victoria 2FA: how to set up an authenticator app

Your Service Victoria account is the Victorian Government login for applying for services and licenses and for the digital cards in the Service Victoria app. Multi-factor authentication (MFA) isn't optional: every account must have it, older accounts are prompted at the next login, and there's no documented way to turn it off (Service Victoria).

You can use text messages to an Australian mobile number or an authenticator app. Without an Australian number, the app is your only choice (Service Victoria). This guide uses Authenticator App - Novaz on iPhone. Any authenticator app works the same way.

How we checked this guide: the Service Victoria steps come from Service Victoria's own help page and how-to guide (including its screenshots) and the Victorian Government's video walkthrough, linked below, which we read on October 19, 2026. We haven't tested them on a Service Victoria account, so a label may differ slightly. The Novaz steps are checked against the app, version 1.0.5.

Turn on 2FA with an authenticator app

You'll see this when you create an account at service.vic.gov.au/account or next log in to an older one. Service Victoria's July 2026 how-to guide and video walkthrough describe it like this (Service Victoria, Victorian Government):

1. On Set up multi-factor authentication, choose Authenticator app, then Next.
2. Service Victoria asks you to install an authenticator app first, and says any standard one works. Install Novaz, then continue.
3. The next screen shows a setup key. In Novaz, tap +, then Enter key manually, and fill in Service, Account (optional) and Setup key. See What is a 2FA setup key?
4. Or choose the option to scan a QR code. In Novaz, tap +, then Scan QR code. If the QR code is on the same iPhone, take a screenshot and use Choose a photo. See scanning a QR code on the same iPhone.
5. Enter the six-digit code from Novaz to confirm the link.
6. On Save your recovery codes, save all 10 codes (there's a Copy codes button), then confirm you've saved them.
7. On Remember this device, choose Remember to skip codes on this device for a year, or Skip.

Service Victoria doesn't say how often its codes change. A typed key gives 30-second codes, while a QR code carries the exact settings. If codes from a typed key fail, remove that entry in Novaz (Remove account) and scan the QR code.

The Service Victoria app then asks for a 6-digit app passcode. That only locks the app.

Switching from text messages

To move from SMS to an app, start logging in, choose I can't do this on the SMS code screen, follow the steps, and pick the authenticator app when asked (Service Victoria).

Your recovery codes are the backup

With the app method, the 10 codes are your recovery method. Secret questions go with text messages, and you can only add them in account settings if text message is your method (Service Victoria).

The setup screen suggests a place you can reach from another device, like a password manager, and warns: "We won't be able to retrieve your account or codes for you." (Service Victoria) Without a Novaz backup, the keys live only on your iPhone, so keep the codes on paper or in a password manager, not only on that phone. See 2FA backup codes.

When Service Victoria asks for a code

The help page says every login, while the newer how-to guide says logins on new devices (Service Victoria). Either way, you can trust up to five phones or computers, and Service Victoria won't ask again on them for a year (Service Victoria).

Resetting a forgotten password takes two codes. After Forgot your password?, Service Victoria emails you one, then asks for another from your MFA method (Service Victoria). Both have six digits, so check which one the screen wants.

If Service Victoria rejects your code

Service Victoria's pages don't cover rejected authenticator codes. Make sure you typed the Novaz code, not an emailed one, then check the iPhone's clock: Settings > General > Date & Time > Set Automatically. Novaz warns you when it's 15 seconds or more off. More in Authenticator code not working?

Changing phones

Service Victoria doesn't document moving the authenticator to a new phone. Keep your old iPhone and your recovery codes until Service Victoria works in Novaz on the new one. If you use Novaz's iCloud backup or a backup file, restoring it on the new iPhone brings the account across. Without one, the key can't come with you, and you'll have to set the authenticator up again with Service Victoria. See How to transfer your authenticator app to a new iPhone.

If you lose your authenticator

• Use a recovery code. One of your 10 codes gets you back in (Service Victoria).
• No codes left? The help page says you'll have to reset your authenticator app, but not how, what proof is needed, or how long it takes. It also mentions opening a new account with a different email address.
• Contact Service Victoria. Send a message under Service Victoria account (replies take up to a week), or ask the virtual assistant, Vicky, for the customer service team, 9am to 5pm on weekdays (Service Victoria). Its pages don't say whether support can reset the authenticator.

More in Lost the phone with your authenticator app?

Official Service Victoria help

• Protecting your account
• Create a Service Victoria account: how-to guide (PDF)
• How to create a Service Victoria account video walkthrough (Victorian Government)
• Contact Service Victoria via chat or message