Two-factor authentication
Green Dot supports optional email-code two-factor authentication (2FA) on top of the standard magic-link flow. When 2FA is on, every sign-in from a device we have not seen before requires a fresh six-digit code, delivered by email, valid for ten minutes.
Turning 2FA on
Sign in to your Green Dot account, open Account → Security → Two-factor authentication, click the switch. A confirmation code is emailed to you immediately — enter it once to prove you can still receive email at the address on file, and 2FA is enabled.
What "a new device" means for us
We fingerprint sign-ins using a combination of your user-agent string and a rotating device cookie. A "new device" is any combination we have not seen for your account before, or any device where the cookie has been cleared. On new devices, 2FA is required. On known devices, 2FA is skipped — the magic link alone is enough.
Why email 2FA and not an authenticator app?
Our threat model for a daily puzzle game is: an attacker who briefly gets hold of your laptop or a colleague who wants to see your streak. Both are stopped by a code sent to your inbox. Full TOTP with QR codes and backup codes adds friction that most players will not tolerate for a game about coloured dots. If you want it anyway, tell us at support — we may add it if enough players ask.
Turning 2FA off
Same panel, same switch, one confirmation code. If you have lost access to the email on the account, 2FA can be lifted by our support team via the manual recovery flow described in how to recover your account.
Backup for a shared account
If several people legitimately use the same Green Dot account (a family plan, for example), keep 2FA off — otherwise every family member will need access to a shared inbox for each new sign-in. For legitimate multi-user play, use a Team plan instead: each person gets their own account, their own cabinet, their own 2FA switch, and the shared puzzle experience.