If you see a token in your Authy app that you didn’t add, we can assure you it does not mean your Authy account was hacked, or that your personal data was exposed. This guide explains how tokens can be added by online services to your Authy account, and how to report unexpected or erroneous tokens.
Overview
When you set up two-factor authentication with an online service, they may ask for your phone number, and then provide that phone number to us to automatically add their token to your Authy app. This is a standard feature of the Authy API (What’s an API?), and it does not give the online service access to your personal data or other sensitive information. To learn more about how online services use Authy, see Why Is The Authy 2FA App Free For Users.
Report a token
If you see a token in your list that you are confident you did not add, or if it contains explicit/offensive language, this is a violation of our terms of service. You can take the following actions to report the token to us, depending on your phone's operating system:
Android devices
- Access the Authy app.
- Go to Settings > Accounts.
- Tap the ellipses (...) to the right of the token you wish to report, and then select Report Token from the menu.
- Fill out the report to request that the Authy team review the token in question.
iOS (Apple) devices
Submit the token’s information in a request to our Support team.