Fix frequent login verification or email authentication prompts
Spendesk requires Strong Customer Authentication (SCA) under PSD2 (European banking regulation) to protect your account. This article explains why you're prompted often and how to reduce it.
For: All Spendesk users on web and mobile.
Before you start
No special role or plan is required — SCA applies to every user, on every plan.
You need access to your email inbox and, if enrolled, your mobile device to complete authentication.
SCA cannot be disabled. It's a legal requirement, not a Spendesk setting.
Why am I asked to verify my login so often?
Spendesk triggers a new authentication in two separate situations:
New or untrusted device (web/browser): If Spendesk doesn't recognize your browser as a "trusted device," you must complete SCA (email link, SMS code, or mobile app confirmation) again. This happens when cookies are blocked, cleared, or you're in incognito/private mode, because Spendesk uses a cookie to remember trusted devices for 180 days.
Mobile app lock: On the mobile app, you're asked for your security code or biometrics after closing the app or after 60 seconds of inactivity. This is a separate, local re-lock mechanism and is not related to the 180-day trusted device period.
If you use an email and password login (not SSO), you'll also see an extra "Confirm your identity" email step to finish sign-in — this step is specific to the email and password method.
💡 Tip: At the end of any SCA prompt, tick "Trust this device for the next 180 days" (or "Don't ask again for the next 180 days"). This is the main way to reduce future prompts on that browser or device.
Reduce prompts on the web app
Log in to Spendesk in your browser.
Complete the requested authentication (email link, SMS code, or mobile app confirmation).
Select the "Trust this device for the next 180 days" checkbox before confirming.
Navigate to your browser settings and enable cookies for helpcenter.spendesk.com and app.spendesk.com.
Verify your browser is not set to clear cookies automatically when it closes.
Avoid signing in from incognito or private browsing windows, since they don't save the trusted device cookie.
Disable browser extensions that block or clear cookies, if you use any.
If prompts continue after these steps, clear your browser cookies once, log in again, and re-select the 180-day trust option.
Reduce prompts on the mobile app
Open the Spendesk mobile app.
Navigate to Profile & settings > Security options > Security code.
Enable biometric authentication (fingerprint or facial recognition) if your device supports it.
👥 Biometric authentication speeds up re-authentication but does not remove the 60-second inactivity lock — this applies to all users.
Troubleshooting
Symptom: I'm asked to verify by email every single time I log in, even after selecting "Trust this device."
Cause: Your browser is blocking or clearing the trusted-device cookie (incognito mode, a privacy extension, or cookie settings).
Resolution: Enable cookies for Spendesk, disable cookie-blocking extensions, avoid incognito mode, and log in again while selecting "Trust this device for the next 180 days."
Symptom: The email verification link I received doesn't work or isn't clickable.
Cause: The link must be opened in the same browser that started the login attempt.
Resolution: Open the email and click the link using the same browser and device you used to start logging in. If it still fails, restart the login from that browser.
Symptom: I entered my mobile security code incorrectly and I'm now locked out.
Cause: An invalid code was entered 3 times in a row.
Resolution: Wait 1 hour before trying again. Support cannot lift this block early. Next time, use "Code forgotten?" instead of guessing.
⚠️ Entering your mobile security code incorrectly 3 times blocks the app for 1 hour. This cannot be reversed by Support.
FAQs
Can I turn off SCA completely?
No. SCA is a legal requirement under PSD2 and applies to all users on all plans.
Does switching to SSO reduce prompts?
The extra "Confirm your identity via email" step only applies to email and password login. Users signing in through SSO don't see this specific step, though SCA on new devices still applies.
How long does the "trusted device" status last?
180 days per device and browser combination, as long as cookies aren't cleared or blocked in the meantime.