Multi-Factor Authentication (MFA) is a critical security layer that protects your access to the Merchant Access Portal (MAP). However, situations can arise where you may not have access to your MFA app — for example, if your phone is lost, stolen, or reset.

That’s where Recovery Codes come in.

Recovery codes are one-time-use backup codes provided to you when you first set up MFA. They serve as a secure fallback option to help you access your account if you're unable to retrieve an MFA code from your authenticator app.

What Are Recovery Codes?

Recovery codes are a list of unique, one-time-use codes generated during your initial MFA setup. These were provided to you with a prompt to download or store them in a safe place.

Reminder: You would have received your recovery codes during the MFA setup process. If you skipped downloading them or no longer have access, you will need to contact our support team to reset your MFA

How to login using your recovery codes.

If you’ve lost access to your MFA device or authenticator app, follow these steps to use your recovery code to log in:

Step 1: On the MFA input screen after logging in with your username, password, and company name, click the link that says:

“Use your emergency recovery codes”

Step 2: You’ll be redirected to the Recovery Code screen where you can enter one of your saved recovery codes.

Note: Each recovery code is single-use only. Once a code has been used, it becomes invalid. Attempting to reuse it will result in an error. If you've used all your recovery codes or no longer have access to them, please reach out to our support team to reset your MFA.

Step3: If valid, you’ll be logged in and redirected to your MAP dashboard.

What Happens After Logging In With a Recovery Code?

Once you're logged in using a recovery code:

• A banner alert will appear on your MAP dashboard notifying you that a recovery code was used.

• You’ll be prompted to reset your MFA setup. We highly recommend doing this immediately to avoid future access issues.

Security Tips & Best Practices

• Store your recovery codes securely. Consider using a password manager or secure digital vault.

• Never share your MAP credentials or recovery codes with anyone — even with colleagues.

• Payfast will never ask you for your MAP password or MFA recovery codes via email, phone, or chat.

If you receive any suspicious messages or requests for your login information, treat them as potential phishing attempts and report them to our team.