​Xero launches two-step security authentication

Xero has launched Two­Step Authentication, an additional layer of security for all Xero customers that helps ensure accounts are not compromised by phishing scams or malware.

The growing cloud company - which fell victim to a phishing attack in October - claims the additional authentication step makes it “much more difficult” for unauthorised people to access Xero accounts.

Two­Step Authentication verifies the identity of a customer logging into the Xero dashboard by requiring them to use their existing password and a second, unique code randomly generated by the Google Authenticator app on their smartphone.

“Protecting our customers’ information and business data is our number one priority,” says Paul Macpherson, Head of Security, Xero.

“That’s why we’ve enhanced Xero to include another layer of control that will make it significantly more difficult for anyone other than the Xero account holder to access their information.

“Data security is an industry ­wide issue that everyone needs to take seriously. We regularly educate our customers on following good security practice in their business at all times.

“Phishing scams that attempt to steal account names and passwords are an ongoing issue for all online and financial services, so it’s vital that businesses everywhere who use these services ensure they have strong passwords and keep their information secure.”

The release comes weeks after Xero users were advised to reset their passwords as a precaution following a small phishing attack aimed at customers of the cloud accounting company.

Going forward, Macpherson says individual Xero users will now have the ability to enable Two­Step Authentication on their account when they log in to Xero.

In addition, a Xero subscriber or manager will be able to see which users in their organisation have enabled Two­Step Authentication.

“Security is a constantly ­evolving issue for the technology industry and everyone who is online,” Macpherson adds.

“We will continue to build in these types of system controls to give our customers as much protection as we can but we also strongly encourage all Xero users - and technology users in general - to remain vigilant about the online solutions they use.”