Remove phone from two factor authentication and only have authentication app

[leviton11]

I called support and they had no clue what the problem even is.

TurboTax needs to provide the use the authenticator app as the SOLE method for authenticating.  Keeping the use of texting a code is a joke. 

[leviton11]

any answers?

[CatinaT1]

You should be able to do this. Do you not have access to the phone number currently associated with your account?

[leviton11]

Yes I have access to my phone and that phone number.

That is not the point.

I do NOT want a phone to be able to receive a code that allows access to my account.

I want access to my account to be restricted to ONLY the use of the authenticator app.

[CatinaT1]

This is what I'm finding.

You can turn off the "opt-in" 2-step verification and switch to an authenticator, but you cannot completely remove a phone number from your account's "Multi-Factor Authentication" (MFA) safety net.

If you are already logged into TurboTax:

1. Look at the sidebar menu on the left (you may need to scroll down).
2. Select Intuit Account.
3. On the "Welcome" screen, select Sign-in & security.
4. Find the section labeled 2-step verification.
5. Toggle the switch to Off.
6. Enter your password to confirm. This stops the "every time" login codes.

 

To switch to an Authenticator App (like Google Authenticator or Authy).

1. In the same Sign-in & security menu, select Authenticator.
2. Follow the prompts to set up your app.
3. Once the app is verified, it becomes your primary way to get codes, effectively "removing" the phone number's role in the 2FA process.

[leviton11]

Will this require that the Authenticator app has to ALWAYS be used to sign in?

If not, then it is not secure.

[CatinaT1]

I would think so. That's the whole point of 2FA and authenticator apps. Did you try it?

[leviton11]

Of course I tried it and I can confirm that there is NO way for force TurboTax to require the code from the authenticator to be entered.   And that totally defeats the purpose of the authenticator app.  Does Intuit really not understand this security concept?