Two-factor authentication and account security

A law firm’s portal account is a high-value target — it opens client files, billing, and communications. Two-factor authentication (2FA) means a stolen password alone isn’t enough to get in.

What’s available

• Google SSO. If your firm signs in with Google, your Google account’s own protections (including its 2FA and passkeys) protect your Mylo Prime access. This is the setup we recommend — manage security in one place.
• SMS one-time codes. For email/password sign-in, enable SMS codes: after your password, a code texted to your phone completes sign-in. SAML SSO for enterprise identity providers is on the roadmap.

Setting it up

Each user enables 2FA from their own account settings and verifies their phone number once. Firm admins should make 2FA the norm — the accounts most worth protecting (admins, anyone touching trust accounting) should never run without it.

Lost phone or changed number

If you can’t receive codes, your firm admin can help you regain access and re-enroll your new number. Admins locked out entirely should contact support — be prepared to verify your identity; we deliberately make account recovery a human process rather than a self-service loophole an attacker could use.

Good hygiene beyond 2FA

• One account per person — see Adding and managing team members.
• Deactivate accounts the day someone leaves the firm.
• Sign out on shared or public computers.
• Treat “urgent” emails asking staff to sign in via a link with suspicion — phishing aimed at law firms is common. When in doubt, type portal.myloprime.com yourself.

Think an account may already be compromised? Deactivate it immediately (any admin can), then report it marked urgent, or email [email protected].