1. OTP/2FA overview?
Two-factor authentication (2FA) is an additional layer of security that requires a user to verify their identity through two separate steps before gaining access to sensitive information (example – your account, guest information, payment details)
Why It Is Important / Why do I need OTP or 2FA:
Enhances account security, ensuring that even if a password is compromised, unauthorised access is prevented without the secondary verification step
Protects sensitive data, safeguards sensitive data from unauthorised access or breaches
Reduces the risk of unauthorised access, minimizing the risk of malicious users gaining access
Industry best practice, with two-factor authentication widely recognised as one of the most effective ways to secure online accounts and prevent unauthorised access
2. When does OTP / 2FA apply
· Select ‘Add Fee’ Triggered at every login to the Channel Manager, requiring verification each time a user accesses their account
· Applies to all users accessing guest information – i.e Bookings module, guest report
· Accessing sensitive payment information – i.e card details, Payment gateway
· When deleting setup details OTP is triggered to verify and complete process – i.e Room types, mapping
· Channel Manager access
· Ability to require verification / OTP when accessing Channel Manager account is available.
· Setup OTP / 2FA for Channel Manager account access
· Setup is per user, and once enabled password and a secondary code will be required to access Channel Manager
· Step 1 – Navigate to My account
· Login to extranet > Select user profile > My account > Two Factor Authentication
· Select how you wish to receive OTP (APP, text, authenticator)
· Follow prompts
· Confirmation will be displayed once setup is successful
3. What else do I need to know about OTP
· Where is the OTP code sent - sent directly to the user's registered email address, except for login OTP which is delivered to the method selected by the user during the initial setup process.
· What is the expiry of OTP – OTP code is valid for 15 minutes
· What if I don’t have the OTP – users have the ability to trigger OTP again, there maybe a cool down period before triggering again