Short answer: Stripe requires two-step authentication on every account — you cannot turn it off. Manage it at Profile → Two-step authentication, where you should add a security key or passkey as your primary method rather than SMS, plus a backup method and your recovery codes. Then review team members and restricted API keys, because those are the routes around your login.
Why Stripe makes it mandatory
Because the account moves money, and Stripe would rather annoy you than reimburse you.
A compromised Stripe account can have its payout bank account changed, so revenue quietly lands somewhere else. It can issue refunds, create fraudulent charges, expose customer records including partial card data, and generate API keys that outlive the intrusion.
Payout redirection is the attack that actually happens. It does not break anything visible, customers are unaffected, and the first sign is a payout that never arrives — by which point a settlement cycle has gone.
Step 1: Review your current methods
- Sign in at dashboard.stripe.com.
- Click your account name (top right) → Profile.
- Scroll to Two-step authentication.
You will already have something enabled, since Stripe enforces it at signup. The job here is upgrading it rather than turning it on.
Step 2: Add a security key or passkey
Stripe supports several methods, and they are not equivalent:
- Security key / passkey (WebAuthn) — the strongest. Bound to Stripe’s domain, so a phishing page cannot use it. See hardware security keys and WebAuthn and FIDO2.
- Authenticator app (TOTP) — solid and universally available.
- SMS — the weakest. Exposed to SIM swap attacks, and businesses with visible revenue are worth the effort of a targeted swap.
Add a security key as your primary and keep an authenticator app as backup. If you run a business on Stripe, buy two keys and register both — losing your only key during a payout dispute is not a situation you want.
For the app method, scan the QR code with Google Authenticator, Aegis, 2FAS, Microsoft Authenticator or a password manager. New to this? What is an authenticator app.
Do not screenshot the QR code, and set this up outside any screen-sharing session with a developer or accountant.
Step 3: Save recovery codes and remove SMS
Stripe provides backup codes. Print them or store them in a password manager — not in a document in the same Google account that signs you into Stripe. See where to store backup codes safely.
Then remove SMS as a method, once your key and app both work. Your account’s real security is set by the weakest method left enabled, not the strongest — leaving a phone number active means an attacker simply takes that route.
Step 4: The parts that bypass your login
This is where Stripe security actually lives, and where most people stop too early.
API keys
API keys work without any 2FA. A leaked secret key gives an attacker programmatic access to charges, refunds and customer data.
- Use restricted keys with the minimum scopes each integration needs, rather than the secret key everywhere.
- Roll any key that has been in a shared repository, a contractor’s laptop, a CI system, or a Slack message.
- Check Developers → API keys for keys you cannot account for, and delete them.
- Never commit keys to Git. Scanning tools find them within minutes of a public push.
Team members
Under Settings → Team, every member is a way in. Review the list, assign the narrowest role that works (Developer, Analyst, Support rather than Administrator), and remove people who have left.
Stripe lets you require two-step authentication for all team members — turn it on. The wider pattern is in 2FA for small teams.
Webhooks and connected apps
Review webhook endpoints and any third-party platforms connected to your account. An old integration with an abandoned service is a live path into your payment data.
Step 5: Bank details and notifications
- Payout bank account — verify it now under Settings → Bank accounts and currencies, and check again after any unusual login alert. This is the target.
- Email notifications — enable alerts for bank account changes, new team members and failed logins.
- Email account security — Stripe’s recovery routes through it, so it needs the strongest protection you have. See Google and Microsoft guides.
The phishing aimed at Stripe users
Merchants receive well-crafted lures: “your account is under review”, “verify your identity to release a payout”, “unusual activity detected”. All lead to a login page that relays your credentials in real time — see can 2FA be hacked?
A security key defeats this outright. With codes, the discipline is behavioural: never sign in from an email link, always type the dashboard URL yourself, and treat urgency as the tell.
Frequently asked questions
Can I disable two-step authentication on Stripe?
No. It is mandatory on all accounts. You can change methods, not remove them — and given what the account controls, that is the right call. See how to turn off 2FA safely for services where it is optional.
Which authenticator app works with Stripe?
Any standard TOTP app — Stripe uses the normal algorithm. See how TOTP codes work.
What if I lose my phone and my key?
Use a recovery code, or Stripe support with identity verification — expect a rigorous process appropriate to a payments platform. See recovering accounts after losing your 2FA phone.
Why is my code rejected?
Usually clock drift on your phone. Turn on automatic network time. More: why 2FA codes get rejected.
Does 2FA protect my customers’ cards?
Partly. It protects dashboard access to customer data. Card details themselves are tokenised by Stripe, and your checkout security depends on your own site — if that runs on WordPress, see 2FA on WordPress.
My account has been compromised. What order?
Change the password and end sessions, verify and correct the payout bank account, roll every API key, review team members, then contact Stripe support. Check your email account too — it is usually where it started (what to do if your email is hacked).
The bottom line
Stripe already forces the basics, so your job is upgrading: a security key as primary, SMS removed, recovery codes stored offline, and then the real work — restricted API keys, a tidy team list, and a payout bank account you have actually looked at this month.
Also selling elsewhere? See our guides for Shopify, PayPal and eBay.