Short answer: On Upwork, go to Settings → Password & Security → Two-Factor Authentication and choose the authenticator app option. On Fiverr, open Settings → Security and enable two-factor authentication, then pick the app rather than SMS. Save any backup codes offline, and make sure the email on each profile is one with strong 2FA of its own.
What you actually lose if this goes wrong
Not the balance — that is usually recoverable. The account.
A marketplace profile is years of reviews, a job success score, badges and rankings that cannot be transferred or rebuilt quickly. Starting again at zero reviews on a platform where clients filter by rating is, for many freelancers, months of lost income.
Attackers know the value. Established profiles get taken over and used to solicit off-platform payments from the seller’s existing clients, or to run fake gigs that collect deposits. By the time the platform intervenes, the reputation has already taken damage — and it is your name attached to it.
Upwork: step by step
- Sign in and click your profile photo (top right) → Settings.
- Open Password & Security.
- Find Two-Factor Authentication and select Enable or Edit.
- Choose your method. Upwork typically offers an authenticator app, SMS, or a security question depending on region and account type.
- Select the authenticator app option, scan the QR code, and enter the six-digit code to confirm.
Upwork also offers device-level trust and login notifications in the same section — turn notifications on. And check the security question option if you have one set; a question whose answer is on your public LinkedIn is not a security control.
Fiverr: step by step
- Sign in and click your profile picture → Settings.
- Open the Security tab.
- Enable Two-Factor Authentication.
- Choose the authenticator app method where offered, otherwise SMS or email.
- Scan the QR code and confirm with the six digits.
Fiverr’s available methods vary by region. If only SMS or email codes appear, use them — any second factor stops the automated attacks that account for most takeovers. Then protect the underlying channel: a port-out PIN for your number, and strong 2FA on the email account.
Which authenticator to use
Any standard TOTP app works with both platforms — Google Authenticator, Aegis, 2FAS, Microsoft Authenticator, Authy, or a password manager. New to it? See what is an authenticator app. Choosing one: best apps for Android or for iPhone.
Two rules while you set up:
- Do not screenshot the QR code. It contains the raw secret key.
- Scan it into two devices while it is on screen if you can. That is the simplest backup that exists, and freelancers cannot afford a lockout during a delivery deadline.
If the QR will not scan, use manual setup key entry.
The email address matters as much as the 2FA
Both platforms recover accounts through your registered email. If that inbox is weakly protected, your marketplace 2FA is protecting a door with an open window beside it.
Make sure the address on each profile is current, is one you fully control, and has a passkey or authenticator app of its own — Google, Microsoft. Then check it for forwarding rules you did not create; that is how quiet, long-running compromises operate.
The scams that target marketplace sellers
2FA stops account takeover. These are the attacks that come at you while you are logged in and working normally:
- “Let’s talk on WhatsApp/Telegram instead.” The single biggest red flag. Moving off-platform removes payment protection and puts you where the malicious file arrives.
- Malicious project files. A “brief”, “design asset” or “test task” that is actually infostealer malware. It takes session cookies and bypasses your 2FA completely — see session hijacking.
- Fake platform emails about policy violations or held payments, linking to a login page that relays your password and code in real time. Always navigate to the site yourself: how 2FA gets bypassed.
- Overpayment and refund requests.
- Requests for your verification code. Neither platform will ever ask. See OTP scams.
- Fake recruiter offers pointing at a “skills assessment” that installs something.
The habit that beats most of them: never log in from a link, and never open an unexpected attachment from an unvetted client. If a brief cannot be shared as text or through the platform, it is worth being suspicious.
While you are in the settings
- Review active sessions and sign out anything unfamiliar.
- Check connected apps — time trackers, portfolio integrations, invoicing tools.
- Verify payout details. Both platforms pay out to a linked account, and changing that is the highest-value move for an attacker. Also see 2FA on Payoneer and PayPal.
- Turn on login alerts so an unfamiliar sign-in reaches you within seconds.
Frequently asked questions
Is 2FA mandatory on Upwork or Fiverr?
Both apply verification to sensitive actions like withdrawals and detail changes, and requirements have tightened over time. Account-level 2FA is worth enabling regardless of whether it is currently forced.
Why is my code being rejected?
Usually clock drift on your phone. Turn on automatic network time. More causes: why 2FA codes get rejected.
What if I lose my phone before a deadline?
Use backup codes if the platform issued them; otherwise support with identity verification, which takes time. Hence the advice to enrol a second device at setup. See recovering accounts after losing your 2FA phone.
I travel and work from different countries. Will that cause problems?
Expect extra verification prompts from new locations. Authenticator codes work fine anywhere — they need no signal and no SIM. See 2FA while travelling.
My account was suspended after a takeover. What now?
Contact support immediately with evidence — your original email, payment history, and the timeline of the compromise. Then secure the email account and scan your machine for malware before regaining access, or the same thing happens again.
Should I use different passwords for each platform?
Yes, unique and stored in a password manager. Password reuse is how most marketplace accounts are actually lost — see credential stuffing.
The bottom line
Ten minutes across both platforms: authenticator app enabled, second device enrolled, login alerts on, payout details checked, and the email behind it properly protected. Then treat every unexpected file and every “let’s move to WhatsApp” as the risk it is — because for freelancers, the account takeover usually starts with a client who is not a client.
Wider checklist for your whole setup: 2FA for freelancers.