🔐 Smarter, More Secure Login — Now with Flexible MFA Options

myKaarma’s login experience has been upgraded to be more secure and flexible, now supporting multiple MFA options including App-based MFA, Email, Text, and SSO.

This update introduces Text MFA as a new option and ensures you always have a backup method available, so you’re never blocked from logging in or processing refunds.

Your existing login method will continue to work as expected — no disruption or changes required.

How MFA Works in myKaarma

Multi-Factor Authentication (MFA) is now mandatory for all users as part of our ongoing commitment to protect your data and safeguard customer information.

• SSO and Authenticator App MFA can be set up with help from myKaarma. Once configured, they will be your default login methods.
• If you are not using SSO or an authenticator app, you can be set up with Email/Text MFA
• Even if you are using App MFA, Email/Text MFA remains available as a backup for logins only
• App MFA generates time-based codes within your authenticator app
• Email/Text MFA sends a one-time code to your registered email or mobile number at login

MFA is also required for processing refunds. Even if you're on SSO, you will need to complete MFA for refund actions using either App MFA or Email/Text MFA.

What is MFA and Why It Matters

MFA is an extra layer of security that confirms your identity with two factors:

• Something you know (like your password), and
• Something you have (like a one-time code)

This dramatically reduces the risk of unauthorized access and helps dealerships stay compliant with FTC’s Safeguards Rule.

MFA-Based Login: How It Works

Here’s what you can expect when logging in with MFA:

• 1. Enter your login credentials. Log in using your myKaarma-associated email address and password.

• 2. Complete verification based on your setup. You will be taken to a 2-step verification screen based on your configured MFA method.
  • a. If using Email or Text MFA: You will receive a 6-digit code via your registered email or mobile number.

  • 

• b. If using App-based MFA: You will be prompted to enter the code generated by your authenticator app (e.g., Google Authenticator, Microsoft Authenticator).
  • You can click “Try Another Method” to switch to Email/Text MFA as a backup.

• 3. Set up Text MFA (if not already configured). If Text MFA is not set up, you will have the option to configure it during login. Enter your mobile number, verify it with a one-time code, and complete setup to enable Text MFA.

• 

• 4. Enter your verification code. Enter the 6-digit code based on your selected MFA method to complete login. You’ll have up to 5 minutes to enter the Email/Text MFA code before it expires. You can resend the code up if needed.
  • Pro Tip: Turn on “Keep me signed in” to skip the MFA code for 30 days. After that, you’ll need to enter the code again.

• 5. Manage your MFA settings. Once logged in, you can review and manage your MFA setup from User Profile Settings. Here you can:
  • View or update your registered email and mobile number
  • Confirm where your Email/Text MFA codes are sent
  • Review or manage your authenticator app setup

🔔 MFA emails are sent from accounts@mykaarma.com. Replies are not monitored.

📩 Having trouble receiving your MFA code on one method? Try the other available method. If the issue persists, contact your admin to request a backup code for login or refund processing.

✅ Already using SSO? You’ll continue logging in the same way—no changes required.

MFA During Refunds

Even if you're on SSO, you must complete MFA when initiating a refund:

• If on App MFA: Enter the 6-digit code from your app. If you're using App MFA, Email/Text MFA won’t be available as a backup for refunds.

  

• If on Email/Text MFA: A code will be emailed as soon as you hit the Refund button. It will remain valid for 5 minutes. You can always click “Resend Code” if the code expires.

  • By default, refund MFA codes are sent to your email. If you prefer to receive the code via text, select Text — the code will be sent to your registered mobile number.

  • If your phone number is not set up or verified, you’ll be prompted to complete setup in your User Profile before using Text MFA.

Backup Codes (For Admins Only)

Dealership Admins can generate temporary backup codes for users who are locked out or can’t access their MFA. These backup codes are universal and can be used with Email, Text, or App-based MFA.

1. Go to: Settings → Users → Manage Users
    
2. Select the user
    
3. Scroll to “Multifactor Authenticator”
    
4. Provide a Temporary Backup Code. You can generate new backup codes if necessary.

Important Notes

• Each backup code is unique to the user.
   
• Each code can only be used once. Once used, the code will turn grey and become inactive. To generate a new set of codes, simply click the “Generate Code” button.

FAQs & Troubleshooting

🔍 What exactly is changing with MFA in myKaarma?

All myKaarma users who log in or process refunds will be required to authenticate using one of the following methods:

💬 I didn’t receive the MFA Code. What should I do?

• Check your Spam or Junk folder.
• Use the "Resend Code" option on the login screen. Try an alternate method to sign-in.
• Still having trouble? Ask your Dealer Admin for a backup code.
• Additionally, ask your admin to verify your email or mobile number and help you set up app-based MFA if needed.

🔐 Can I use both App and Email MFA?

Yes. If you set up an authenticator app, you can still use Email or Text MFA as a backup for logins.

🔄 Can I switch to Authenticator App-based MFA from Email MFA?

Yes. You can find a detailed guide for setting up App MFA here.

Download an authenticator app that generates time-based codes (such as Google Authenticator, Microsoft Authenticator, or Authy), and ask your Dealer Admin to help you set it up. You can continue using Email/Text MFA as a backup. 

📵 Is Text-based MFA supported?

Yes. Text (SMS) MFA is supported and can be used for both login and refunds.

⏳ What’s the MFA code expiry time?

Your MFA code is valid for 5 minutes. After that, you’ll need to resend for a new one.

🔁 How often can I resend the MFA code?

You can resend as needed, but allow 30–60 seconds between requests to avoid delays. If you enter the MFA code incorrectly 10 times, your account will be locked.

📥 What if I reply to the MFA email?

Replies to accounts@mykaarma.com are not monitored. For help, contact support@mykaarma.com.

🛠 I’m a Dealer Admin. How can I help?

• Share this information with your team.
• Make sure users confirm their email addresses.
• Contact myKaarma support if users need help switching to an authenticator app or updating email addresses.

Final Takeaway

• Multi-Factor Authentication (MFA) is now mandatory for all users in myKaarma.
• Users not on SSO or an Authenticator App for MFA will be transitioned to Email/Text-Based MFA by default for login and refunds.
• Questions? Reach out anytime to support@mykaarma.com. We’re here to help make your login experience secure and seamless.