Two-Factor Authentication for Your Whole Team
A broker's password is the only thing standing between a stranger and every merchant file they can see. Two-factor sign-in changes that math. Here is how to roll it out.
Picture Monday morning. One of your brokers gets an email that looks exactly like a sign-in prompt from the shop's file storage. It says a funder shared a document. They click, enter their username and password, see an error and move on with their day. By lunch, someone in another country has logged into your CRM as that broker and is scrolling through statements, applications and Social Security numbers.
That scenario plays out because a password is a single secret that can be phished, guessed, reused from an old breach or read off a sticky note. Two-factor authentication adds a second check, something the person has, usually a code from an app on their phone, so a stolen password alone is not enough to get in.
This guide covers why two-factor sign-in matters specifically in a funding shop, which methods to choose, how to handle the inevitable lost phone, and how to roll it out to a floor full of brokers who would rather be dialing.
Pre-flight summary
- A password alone can be phished or reused; a second factor blocks most account takeovers.
- Authenticator apps are a strong default; consider hardware keys for owners and admins.
- Issue recovery codes at enrollment and define a recorded manager-reset process.
- Roll out leaders first, enroll together, then require it for everyone with no convenience opt-outs.
- Protect email and every other system that touches merchant data, not just the CRM.
Leg 01Why funding shops are an attractive target
Your CRM holds exactly what fraudsters want: verified business owners with bank account details, revenue history and identity documents. A single compromised broker login can expose hundreds of merchants. Worse, an attacker inside your system can impersonate your shop, emailing merchants with fake payoff instructions or redirecting funds.
Funding floors also have characteristics that make passwords weaker than usual. Turnover means accounts get created and handed off quickly. Brokers work from phones, home laptops and shared desks. Speed is prized, so people reuse easy passwords. None of that is a character flaw; it is the environment. Two-factor sign-in is the control that holds up in that environment.
Leg 02Choosing a second factor
Not every second factor is equally strong. The general ranking, from weakest to strongest, looks like this.
- Codes sent by text message: better than nothing, but vulnerable to SIM swapping and number porting, which matters in an industry that lives on phone numbers.
- Codes from an authenticator app: a time-based six-digit code generated on the phone itself, not sent over the network. A strong, practical default for most teams.
- Push approvals in an app: convenient, but train people never to approve a prompt they did not trigger.
- Hardware security keys: the strongest common option and highly resistant to phishing, worth considering for owners and anyone with export or admin rights.
Leg 03Recovery codes and the lost-phone problem
Every two-factor rollout eventually meets a broker who dropped their phone in a parking lot. Plan for it before it happens, or you will end up disabling security in a panic to get someone back on the phones.
When a person enrolls, they should receive a set of one-time recovery codes. Each code works once in place of the authenticator. The broker should store them somewhere safe and separate from their phone, such as a password manager or a printed sheet kept at home. Recovery codes are not something to keep in the notes app of the same phone they are meant to replace.
Then define a manager-level reset process. If someone loses both phone and codes, a manager or owner verifies their identity in person or on a video call, resets their second factor, and the reset is recorded. FundPilot logs those administrative changes in the audit trail, so a reset never happens silently.
Decide how you will handle a lost phone before rollout day, or you will end up switching security off in a hurry.
Leg 04A rollout plan brokers will actually follow
The technical part of enabling two-factor sign-in takes minutes. The human part takes a week of planning. Here is a sequence that works on a busy floor.
- Start with owners, managers and anyone who can export data. They set the example and they hold the most access.
- Announce a date a week out and explain the reason in one sentence: a stolen password should not open merchant files.
- Run a ten-minute enrollment session during a slow block, with everyone installing an authenticator app and scanning their code together.
- Have each person save their recovery codes on the spot, and confirm they did.
- Switch the requirement on for all accounts on the announced date, with no opt-out for convenience.
- Write the lost-phone reset process down and pin it where managers can find it.
- Add two-factor enrollment to new-broker onboarding so it happens on day one.
Leg 05Beyond the CRM
Two-factor sign-in on your CRM is the headline, but attackers look for the weakest door. Email accounts are especially important, because whoever controls a broker's email can often reset passwords elsewhere and send convincing messages to merchants and funders.
Make a short list of every system that touches merchant data or money: email, file storage, banking, payroll, domain registrar and phone system. Turn on the strongest second factor each one supports. If your team already works inside FundPilot's office suite for documents, file storage and team chat, more of that list sits behind a single protected sign-in, which leaves fewer doors to watch.
Leg 06Handling the pushback
Expect a few complaints. Brokers will say it slows them down. In practice, most authenticator setups ask for a code only on a new device or after a period of time, so the daily cost is a few seconds. Some will object to putting a work app on a personal phone; offer a hardware key as an alternative rather than an exemption.
The strongest argument is a concrete one. Walk the team through what an attacker could do with one broker's login: read every file in their pipeline, message their merchants, change bank details. Framed that way, two-factor sign-in stops looking like IT bureaucracy and starts looking like protecting their own book of business.
Questions from the floor
Are text message codes good enough?
Text codes are better than a password alone, but they rely on the phone number staying under the person's control. Number porting and SIM-swap fraud can redirect codes to an attacker. Because funding shops depend heavily on phone numbers, an authenticator app or hardware key is a stronger choice. If text codes are the only option for a given system, use them while you look for something better.
What happens when a broker leaves the company?
Disable their account the day they leave, which also invalidates their second factor. Because deals belong to the company rather than the person, their pipeline can be reassigned to another broker without sharing credentials. Review the audit trail for unusual exports or downloads in the weeks before departure, and remove their access to email and any other systems on the same day.
Will two-factor sign-in slow down my floor?
Usually only slightly. Most setups ask for a code when someone signs in on a new device or after a set period, not on every click. Enrollment takes a few minutes per person. The bigger time risk is the lost-phone scenario, which is why you prepare recovery codes and a reset process in advance so nobody sits idle waiting for help.
General information only — not legal, tax or financial advice. Rules for telemarketing, texting, recording, disclosures and data retention vary and change; confirm current requirements with qualified counsel.
Connecting flights