Account security: two-factor authentication and suspicious logins

Introduction

Fotostudio now includes several mechanisms to protect your account: two-factor authentication (MFA), detection of unusual logins, login history, and automatic sign-out of other sessions when you change your password.

Two-factor authentication (MFA)

What is it?

Two-factor authentication adds a second step to your login. After entering your password, you type a 6-digit code generated by an authentication app on your phone. Even if someone steals your password, they can't get into your account without your phone.

Which app should I use?

Fotostudio's MFA relies on the TOTP protocol (open standard RFC 6238), which works with every authentication app on the market:

• Google Authenticator (iOS / Android)
• Authy
• Microsoft Authenticator
• 1Password, Bitwarden, etc.

Enable MFA

1. Go to My account > Security and click Enable two-factor authentication
2. Install an authentication app on your phone
3. Scan the QR code shown with your app
4. Enter the 6-digit code generated by the app to confirm
5. Choose the verification frequency (see below)
6. Save your recovery codes (critical step, see the dedicated section)

Verification frequency

When you enable it, you choose when the code is requested:

Note: in "unknown browser" mode, if you always come back on the same browser without clearing your cookies, you won't be asked for the code for 90 days. This is a deliberate convenience choice, similar to how major sites like Google behave.

Disable MFA

Go to My account > Security, click Manage next to two-factor authentication, then Disable. You'll be asked to confirm.

Recovery codes

Why they matter

If you lose access to your phone (theft, breakdown, new app), recovery codes are the only way to log in. Without them, your account would be locked.

How they work

• When you enable MFA, 10 recovery codes are generated and shown only once
• Each code has the format XXXX-XXXX-XXXX
• Each code is single-use: once used, it's permanently invalidated
• You use them instead of the TOTP code on the MFA login page

How to save them

• In your password manager (1Password, Bitwarden…)
• In an encrypted file
• Printed and kept somewhere safe

Regenerate the codes

If you're getting close to 0 remaining codes, or if you think your codes have been compromised:

1. Go to My account > Security and click Manage next to two-factor authentication
2. Click Regenerate recovery codes
3. The old codes are invalidated immediately
4. Save the new codes

The number of remaining codes is shown on the Security page. A warning appears automatically when 2 or fewer are left.

Detection of unusual logins

Fotostudio automatically checks every login and compares the country of the current IP address with the country of the last known login.

What happens after a suspicious login?

Automatic alert email: you receive an email showing:

• The detected country
• The IP address
• The date and time of the login
• A direct link to change your password
• A link to enable MFA if you haven't yet

If MFA is enabled: even if your browser was marked as "trusted", the TOTP code is requested again automatically when you log in from a different country.

What doesn't trigger an alert

• Same country, different IP address (network change, 4G to WiFi, etc.)
• Logins from local addresses (internal network, development)

If you receive an alert email and you didn't make that login, change your password immediately with the link in the email.

Login history and Security page

The My account > Security page gathers all your account's security information:

MFA status

• If MFA is active: activation date, number of recovery codes left, Manage button
• If MFA is inactive: Enable two-factor authentication button

Login history

Shows the last 50 logins to your account with:

Changing your password

When you change your password in My profile (Password section), several security actions happen automatically:

1. All your other active sessions are signed out: anyone logged in to your account on another device is logged out immediately
2. Trust is revoked on all MFA devices: the TOTP code will be requested again on every device at the next login, even those previously remembered

Protection against brute force attacks

On top of MFA, Fotostudio automatically limits login attempts:

Beyond these limits, access is temporarily blocked.

If you see a message saying your account is locked when you try to log in, wait 1 hour for it to unlock automatically, or contact support to have it unlocked right away.

FAQ

Q: My TOTP code isn't accepted.
Check that your phone's time is set to sync automatically. A clock that's out of sync prevents the code from being validated. If the problem continues, use a recovery code and enable MFA again.

Q: I lost my phone and I no longer have my recovery codes.
Contact Fotostudio support. We'll need to verify your identity before disabling MFA on your account.

Q: I get an alert email every time I log in, even from home.
Your internet provider may be changing your IP address regularly (dynamic IP). If the country stays the same, no email is sent. If you use a VPN, the detected country can vary depending on the VPN server.

Q: Is MFA mandatory?
No, it's optional. But we strongly recommend it, especially if your account holds client data, billing information or linked bank access.

Updated on: 30/10/2026