Identity Verification Added for Payroll Settings Updates

We're introducing an additional identity verification step when users make sensitive changes to their payroll account settings. This update strengthens the protection of your team's payroll accounts against unauthorised access.

What's changing

When a user attempts to make a sensitive change, such as updating their password, changing their registered email address, or modifying their two-factor authentication (2FA) settings, they will be prompted to re-verify their identity before the change can take effect.

Verification uses the user's primary authentication method:

• Users with 2FA enabled: Authenticator app code, SMS one-time code, or passkey.
• Users without 2FA enabled: Password followed by a one-time code sent to their registered email address.

Note: To ensure complete account security, any request to change a registered email address will always require identity verification across all instances, regardless of prior authentication status.

What your users will experience

• Fast and familiar: Verification takes less than 30 seconds using methods users already have set up.
• 10-minute grace period: If a user completed a 2FA challenge within the last 10 minutes (e.g., during login), they won't be re-prompted immediately for most settings updates.
• Single session verification: Once verified, users won't be re-prompted for additional settings changes made within the same 10-minute window.

Why we're making this change

Sensitive account settings, particularly password, email, and 2FA configurations, are prime targets if an active session is compromised.

This update ensures that even if an unauthorised third party gains access to an active session, they cannot modify critical account credentials without completing a second factor of authentication.