Multi Factor Authentication (MFA) gives your account additional security. It requires at least two pieces of evidence from a user before they can access a Click & Drop account. This includes the usual password, and one other method.
There are three verification methods that your users can use to confirm their identity, email verification, authenticator apps, or by entering a recovery code.
This feature is currently optional, but will become mandatory later.
To activate MFA for your users, navigate to Settings > User Management, and click the new 'Admin Settings' button.
A popup window will appear that will allow you to turn 2-step verification on for all accounts.
Note - you can currently switch this feature on or off for all users on your account,. but when this feature becomes fully mandatory, you will need to contact our support teams if you wish for emails in your account to be excluded. Excluding emails from MFA carries a security risk.
If you are happy to proceed, check the box and click 'Save'.
Verifying your email for the first time
When 2-step verification is on, all users on your account will see a new popup when they next log in.
The first time they see this popup your users must verify their email address first before any other methods can be selected. This is so we can verify the email address against the user is available and active. Your user will receive an email with a code that will be entered into the website.
Note: You should use this opportunity to check that the users on your account are active and still have access to their email addresses. Any users that no longer require Click & Drop access, or can no longer access their emails should be deleted from your Click & Drop account.
We will send an 8-digit code to your email address. The email may take a few moment to arrive. If you have not received an email, please check your junk folders.
Enter the 8 digit code into the website and click the 'Verify' button to continue.
There is an optional checkbox to 'Remember this device for 30 days' that you can check at this stage.
This option skips the login step for 30 days on the device you're using.
Enable this setting only if:
- The device is yours alone, and no one else logs into it
- It's password- or PIN-protected, and locks automatically when idle
- You're not on a shared family computer, a work kiosk, an internet café, or a borrowed device
- You're on a public or shared computer
- You're using someone else's device, even briefly
- The device doesn't lock itself or isn't password-protected
Verifying your email on further occasions
When you have verified your email for the first time, the additional options will no longer be greyed out.
Explanation of options:
Email verification: Verify with code sent to your email address
Authenticator app: Add Click & Drop to your authenticator app for easier future logins
Recovery codes: Generate a code that can be used to help get you back into your account in future.
Troubleshooting
Why didn't my verification code arrive?
If your verification code didn't arrive, please check the following:
- Check the email did not go into your junk or spam folder
- Make sure your email provider is not blocking emails from Royal Mail
- Make sure your mailbox isn't full
- If you have a forwarding rule to automatically forward emails from one Hotmail, Outlook, or Live email address to another, your Royal Mail verification code may not arrive at the forwarded address. This is an issue with Microsoft's email security policies and isn't specific to emails sent from Royal Mail. You may need to check the original mailbox directly, or ensure no-reply@royalmail.com is marked as a safe sender.
- Some mail clients not listed here also have issues when emails are redirected, according to their own policies. You may need to check the original mailbox directly, or ensure no-reply@royalmail.com is marked as a safe sender.
- Sometimes emails may take a few moments to arrive. We recommend waiting a few minutes before trying again.
- Verification emails have a 5 minute duration before they expire. If you have a system in place that redirects emails, please check the redirection does not take longer than 5 minutes.
Important note: While we can offer you support, our support team are not able to diagnose issues you have with your own email servers. If you still cannot successfully receive our emails containing verification codes, you should contact your email provider before contacting Royal Mail support.