Canada Visa: IRCC Implements Mandatory Multi-Factor Authentication

Starting July 31, 2023, the Immigration, Refugee, and Citizenship Canada (IRCC) is taking significant measures to enhance the security of user accounts. As part of this initiative, all users creating new accounts or signing in through GCKey will be required to set up multi-factor authentication (MFA).

This mandatory step aims to safeguard personal information and prevent unauthorized access to IRCC accounts.

What is Multi-Factor Authentication (MFA)?

Multi-factor authentication is an additional layer of security that goes beyond the traditional username and password login process. It requires users to provide an extra piece of information to confirm their identity when accessing their accounts. This additional step is crucial in protecting sensitive data from potential threats.

Accounts Requiring Multi-Factor Authentication

If you have an IRCC account and use GCKey to sign in, you will be required to enable multi-factor authentication. However, if you use the Sign-In Partner option, MFA is not mandatory.

The following IRCC accounts require multi-factor authentication when accessed through GCKey:

1. IRCC Secure Account
2. Authorized Paid Representatives Portal
3. Employer Portal
4. Provincial and Territorial Partner Portal
5. Designated Learning Institutions Portal
6. Provincial and Territorial Public Health Authority Portal
7. Partner Portal (to access the Visa Application Centre Portal and the Validation Portal)

Registering for Multi-Factor Authentication

The process to register for multi-factor authentication is simple and secure. Follow these steps to set it up:

Step 1: Sign in or create an account using GCKey

When signing in to an existing account or creating a new one through GCKey, you will be prompted to register a device or provide an email address for multi-factor authentication.

Step 2: Choose a Multi-Factor Authentication Method

You have three methods to choose from when setting up multi-factor authentication:

1. Use your smartphone or tablet (recommended): Download an authenticator application and scan the QR code or enter the secret key provided to generate a 6-digit passcode.
2. Use your desktop or laptop: Download an authenticator application and enter the secret key provided to obtain a 6-digit passcode.
3. Use an email address: Enter your email address and receive a one-time 6-digit passcode via email.

No personal information is shared between the third-party application and the Government of Canada, ensuring the security of your data.

Step 3: Save your Recovery Codes

After confirming your multi-factor authentication method, the system will present you with 5 recovery codes. Store these codes in a secure and accessible place. They will be helpful in case you lose or damage your device, reinstall the authenticator app, or change your phone number.

Using Multi-Factor Authentication

Once you have registered for multi-factor authentication, every time you sign in to your account, you will be prompted to enter the authenticator code from the app or the one-time passcode from your email.

Recovering or Resetting Multi-Factor Authentication

If you encounter issues with your multi-factor authentication, such as losing your device or wanting to change your authentication method, follow these steps:

1. Sign in to your account.
2. When prompted for your multi-factor authentication code, select “Recover account.”
3. Enter one of the recovery codes you saved during the initial setup.
4. If you wish to change your device or authentication method, select “Change your two-factor authentication.” The system will prompt you to set up multi-factor authentication again, providing new recovery codes.

Always ensure you save your new recovery codes in a safe location, as the old recovery codes will no longer be valid.

Remember, if you lose your recovery codes without a backup, you will need to create a new account to access IRCC services.

By implementing multi-factor authentication, IRCC aims to provide its users with an added layer of protection and peace of mind while accessing their accounts. Stay secure and protect your personal information with this essential security measure.