Skip to main content
Multi-factor authentication (MFA) adds an extra layer of security to your Forerunner account by requiring a verification code in addition to your password. Even if someone obtains your password, they can’t access your account without the verification code.

​
How MFA works

When MFA is enabled, signing in requires two steps:
  1. Something you know - Your email and password
  2. Something you have - A verification code sent to your phone
This two-factor approach significantly reduces the risk of unauthorized account access.

​
MFA methods in Forerunner

​
SMS verification

Forerunner uses SMS-based verification for team member accounts:
1

Sign in with password

Enter your email and password on the sign-in page.
2

Receive code

A verification code is sent via SMS to your registered phone number.
3

Enter code

Type the 6-digit code into Forerunner.
4

Access granted

Once verified, you’re signed in to your account.
MFA via SMS requires a mobile phone capable of receiving text messages. If you have limited cell service, contact your CSM to discuss alternatives.

​
Setting up MFA

If your account requires MFA and you haven’t set up a phone number:
1

Sign in

Enter your email and password as usual.
2

Add phone number

When prompted, enter your mobile phone number.
3

Verify phone

Receive a verification code via SMS and enter it to confirm your number.
4

Complete setup

Your phone is now registered for MFA. Future sign-ins will send codes to this number.
Use your personal mobile number rather than a shared office phone to ensure only you can receive verification codes.

​
Managing your MFA phone number

​
Updating your phone number

To change the phone number used for MFA:
1

Go to settings

Click Settings in the left sidebar to open My profile.
2

Find phone settings

Find the Mobile phone number field.
3

Verify current number

You may need to verify your identity with a code sent to your current number.
4

Enter new number

Provide your new phone number.
5

Verify new number

Enter the verification code sent to your new phone.
Keep your phone number current. If you lose access to your MFA phone, you may be locked out of your account.

​
When MFA is required

Managers turn MFA on or off for the whole account in Settings > Account > Security:

​
Account-wide MFA

When enabled for the account:
  • All team members must complete MFA setup
  • MFA is required on every sign-in
  • Phone numbers become mandatory profile fields
MFA is either on for everyone in the account or off. There’s no per-user opt-in.
Other roles can see the MFA setting but can’t change it. Ask a Manager if you think it should change.

​
Troubleshooting

Try these steps:
  • Wait 1-2 minutes for the code to arrive
  • Check that your phone has cell service
  • Verify the phone number on file is correct
  • Request a new code by clicking “Resend code”
  • Check if your phone blocks messages from short codes
If you request too many codes in a row, you’ll see a message asking you to enter the most recent code sent to your phone, or wait 10 minutes to request a new one.If codes still don’t arrive:
  • Contact your carrier to ensure SMS short codes aren’t blocked
  • Contact your Manager or CSM for assistance
MFA codes expire after a short period (typically 5-10 minutes). Request a new code and enter it promptly.
If you no longer have access to your MFA phone number:
  1. On the code screen, click Locked out? Request to reset your Multi-Factor Authentication. This sends a reset request to a Manager or Forerunner support.
  2. Or ask a Manager to open your user in Settings > Users > Team and select Reset MFA.
  3. Set up a new phone number the next time you sign in.
If you have a new phone number:
  1. Sign in using your old number if still accessible
  2. Update your phone number in settings
  3. Verify the new number
If you can’t sign in at all:
  • Contact your Manager for MFA reset assistance
If the wrong number was registered:
  1. Contact your Manager
  2. They can select Reset MFA on your user in Settings > Users > Team
  3. You’ll add the correct number the next time you sign in
If MFA is newly required for your account:
  1. You’ll be prompted to add a phone number at sign-in
  2. Enter your mobile phone number
  3. Verify with the code sent to your phone
  4. MFA is now configured for future sign-ins

​
Security considerations

​
Why MFA matters

MFA protects against common security threats:

​
Best practices

Protect your phone
  • Keep your phone physically secure
  • Use a screen lock (PIN, fingerprint, or face recognition)
  • Don’t share verification codes with anyone
  • Be cautious of unexpected MFA prompts
Keep information current
  • Update your phone number immediately when it changes
  • Notify your Manager if you lose your phone
  • Don’t use temporary or shared phone numbers
Recognize suspicious activity
  • Question unexpected MFA prompts when you’re not signing in
  • Report MFA codes you didn’t request to your Manager
  • Never share codes with anyone, even if they claim to be from Forerunner
Forerunner will never ask for your MFA code via email, phone call, or support chat. Only enter codes on the official Forerunner sign-in page.

​
MFA for different user types

​
Internal team members

MFA for staff accounts:
  • Configured via SMS verification
  • Phone number stored in user profile
  • Required based on account settings

​
Public users

Public website users (residents):
  • Do not have MFA requirements
  • Use password-based authentication only
  • Protected by email confirmation

​
Forerunner administrators

Internal Forerunner team members may use additional MFA methods not covered here.

​
Account-level MFA settings

Managers can change these in Settings > Account > Security: Other roles can see these settings but can’t change them.

​
Disabling MFA

MFA can only be turned off for the whole account, by a Manager in Settings > Account > Security. Individual users can’t opt out when MFA is on. If you think MFA should be turned off for your account, talk to a Manager.
MFA is a security best practice and is recommended for all accounts. Disabling MFA increases risk of unauthorized access.