Your TIC account holds things worth protecting: your trading journal, your notes, your capital plan, and for some users a connected broker journal. This spotlight explains how 2FA works in the TIC app and on TIC Desk, what the safeguards are, and where its protection ends.
How do you turn on two-factor authentication in the TIC app?
Open your profile and choose Two-Factor Authentication, or go to the Account screen on TIC Desk. Setup takes about a minute:
- Begin setup. You need an authenticator app such as Google Authenticator, Microsoft Authenticator or Authy.
- Scan the QR code, or type the setup key manually if you cannot scan.
- Confirm with a code. Enter the 6-digit code your authenticator shows. 2FA only switches on after this succeeds, so a mis-scanned QR code cannot lock you out.
- Save your backup codes. The app shows 8 single-use backup codes once. Store them somewhere safe and offline.
It is part of the free app, not a paid add-on, and it is the same account on phone and desktop.
What happens when you sign in with 2FA on?
After your first sign-in step succeeds, the app holds your session for up to 5 minutes while it waits for the code. The codes follow the open TOTP standard (RFC 6238): your authenticator and TIC's server each compute a new code every 30 seconds from a shared secret, so no code travels by SMS.
Four safeguards sit behind that screen, all confirmed in the app's code:
| Safeguard | What it does |
|---|---|
| Small clock tolerance | Accepts the current 30 second code plus one step either side, to absorb phone clock drift, and no wider |
| Replay guard | The same code cannot be used twice within its time window |
| Attempt limit | 5 wrong codes within 15 minutes locks further attempts for that window |
| Code needed to switch off | Disabling 2FA or regenerating backup codes requires a current code, so a stolen session cannot quietly remove it |
What are backup codes, and why are they shown only once?
Backup codes are your way in if you lose your phone. Each is 10 characters and works once. TIC stores only a one-way hash of each code, which is why the app warns that the codes are shown once and cannot be recovered for you. The app shows how many remain and prompts you to regenerate when you are down to two or fewer.
Will TIC tell you about a sign-in from a new device?
Yes, by email. When your account signs in from a device and network combination it has not seen in the last 90 days, TIC sends a security alert showing the device type, time and IP address. Your very first sign-in does not trigger one. The alert is informational, not blocking, so it can also fire when you switch from Wi-Fi to mobile data or update your phone. If it was not you, change your password straight away and contact support.
What can 2FA NOT protect you from?
Being honest about limits is part of using it well.
The US National Institute of Standards and Technology states in its digital identity guidelines (SP 800-63B) that authenticators requiring manual entry of a code, including one-time codes, are not considered phishing-resistant. A fake login page can ask for your password and your current code and use both at once. Only sign in through the app or the official TIC Desk address, and treat anyone asking for your 2FA code as a red flag. Our scam warning page lists impersonation tactics to watch for.
TIC 2FA protects your TIC account. It does not protect your broker account or the email inbox used for password resets. Turn on 2FA there too. The UK's National Cyber Security Centre lists email alongside banking among the most important accounts to protect with 2-step verification, and your inbox matters doubly because it can reset other passwords.
Security protects access, not outcomes. Losses from trading decisions are a separate risk that no login setting changes.
Who is it for, and what about privacy?
Everyone with a TIC account, and especially anyone who keeps a detailed trading journal or uses the same account across phone and desktop as described in our TIC Desk overview. Your authenticator secret is stored encrypted on TIC's server, and backup codes are stored only as hashes. You can download the free TIC app and switch 2FA on in your profile settings.
Sources
- IETF, RFC 6238: TOTP, Time-Based One-Time Password Algorithm
- NIST, SP 800-63B: Authentication and Authenticator Management
- UK NCSC, Turn on 2-step verification for your email
Feature details reflect the TIC app and TIC Desk as checked on 12 October 2026 and may change in later releases.
Trading carries high risk and you may lose your capital. Past performance does not guarantee future results. Educational only, not investment advice.
Available on iOS and Android
iOS — App Store
iPhone and iPad — free download
Android — Google Play
All Android devices — free download
Download TIC Free Today
Full academy, paper trading, and four calculators — no credit card required. Upgrade to Pro or Elite when you're ready.
The TIC App subscription is separate from the copy-trading 30% performance fee — they are two independent services.
Verify any trader's results in 10 minutes
Seven checks that reveal whether a track record is real: third-party verification, maximum drawdown, trade count, and the martingale warning signs. Use it on anyone — including on us.
We'll send the checklist plus occasional TIC insights. We never share your email, and you can unsubscribe any time.
