How to help a user who has lost access to their authentication method
A guide for Account Owners and Administrators to restore a user's access via a recovery code.
For: Account Owners and Administrators.
Before you start
Role needed: only an Account Owner or Administrator can generate a recovery code.
This article applies only when a user can still log in to Spendesk but is blocked at the extra verification step (Strong Customer Authentication, or SCA) — for example, because they lost their phone, changed phone number, changed devices, or deleted their authentication app.
This is different from a user who has forgotten their password or is fully locked out of their account.
Context: what this article is about
Spendesk uses Strong Customer Authentication (SCA) to keep accounts secure. SCA is an extra verification step required when signing in or approving certain actions. It works through one of the following methods:
An authenticator app (such as Google Authenticator), which generates a temporary code.
SMS, where a one-time code is sent to your registered phone number.
The Spendesk mobile app, which sends a push notification to approve the action.
ℹ️ This is not about a user who has forgotten their password or been fully locked out of their account. It only applies to users who cannot complete the SCA verification step.
User perspective: what the blocked user experiences
When a user has lost access to their authentication method, they will:
Be able to reach the Spendesk login page and enter their credentials normally.
Get stuck at the verification step, where they are asked for a code or approval they can no longer generate or receive.
Need to contact their Account Owner or Administrator to request a recovery code.
The user should reach out through a trusted channel (for example, a direct message or phone call). They should not rely solely on email, as their email account may also be at risk.
Admin or Account Owner perspective: how to restore access
Once a user has reached out for help, an Account Owner or Administrator can generate a recovery code on their behalf.
⚠️ Warning: Always verify the requester's identity before taking any action. If phishing is suspected, treat the account as compromised and do not proceed.
Navigate to Settings > Organisation.
Open the blocked user's profile and click "Edit member's profile".
Navigate to the "Security" tab.
Click "Generate a recovery code".
Click "I confirm" on the confirmation prompt, only if you are certain of the requester's identity.
Choose how to share the recovery code: "Manual sharing" (the code is displayed on screen — use this if you have any doubts, and share it via a different channel from the one used to contact you, for example a phone call rather than email) or "Email delivery" (the code is sent automatically to the user's registered email address — use this only if you are fully confident in their identity and their email account is not at risk).
Authenticate yourself when prompted.
The recovery code is delivered — either sent by email automatically, or displayed for you to share manually.
What happens next (user side)
Once the user receives the recovery code, they can use it to bypass the verification step and sign back in to Spendesk:
Sign in to Spendesk.
Click "Use an alternate authentication method".
Click "Enter a recovery code".
Enter the recovery code to complete sign-in.
💡 Tip: Once back in, make sure to set up a new authentication method — either a new authenticator app, SMS, or the Spendesk mobile app — to avoid losing access again.