Should every login at a dealership use two-step verification?
Yes. A dealership login opens customer phone numbers, emails, trade-ins and often credit applications, and passwords at a dealership get shared, reused and written down. Two-step verification adds a six-digit code from the person’s own phone, so a password that leaks or walks out the door is no longer enough to get in.
Why are dealership logins a target?
Dealership logins are a target because of what sits behind them. One account opens thousands of customer names, phone numbers, emails, trade details and credit information. That data is valuable, and dealerships are busy, high-turnover places where passwords get shared at the desk and reused across every site a rep uses.
Most break-ins are not clever. Somebody reuses the same password on a site that gets breached, or types it into a page that only looks like the real one. The attacker does not need to know anything about car sales. They just need a password that works.
Turnover makes it worse. A rep leaves on a Friday and their login is still live on Monday. A shared desk account has been around so long nobody remembers who knows it.
What does two-step verification actually stop?
Two-step verification stops someone who has only the password. After the password, the login asks for a six-digit code that changes every thirty seconds and lives in an app on the person’s own phone. A leaked, guessed or shared password is useless without that phone in hand.
It does not replace good habits. People still need their own logins, and a manager still needs to switch off an account when someone leaves. What it removes is the most common way in: a password that ended up somewhere it should not be.
Does two-step verification slow salespeople down?
Barely. The code is only asked for when someone signs in fresh, not every time they open a customer. Most reps stay signed in on their own phone and computer for days. Opening the authenticator app and typing six digits takes a few seconds, a few times a week at most.
The real friction is the lost phone. A rep upgrades their phone, forgets to move the app, and is locked out on a Saturday. Any setup worth using needs a fast way for a manager to reset it without a support ticket.
Who at a dealership should turn on two-step verification first?
Start with the people whose login opens the most. Managers and admins see every customer in the store. Finance staff handle credit applications and lender decisions. Anyone who signs in on a shared computer at the desk is at more risk than someone signing in on their own phone.
Then bring in the floor. A rep’s login only opens their own customers in most setups, but that is still hundreds of phone numbers and emails, and reps are the people most likely to reuse a password. Rolling it out over a couple of weeks, managers first, gives you people who can help the next group set it up.
How does two-step verification work in bkd.ai?
Anyone in bkd.ai can turn on two-step verification in Settings, under Sign-in security, by scanning a code with an authenticator app. From then on every new sign-in asks for the six-digit code, on the web and in the mobile app. If a rep loses their phone, a dealership admin resets it from Team settings.
It is optional and per person today, so a store can start with its managers and anyone who handles finance. An admin cannot use a password-only session to strip someone else’s protection, and resetting an admin’s own two-step goes through bkd.ai support.
Frequently asked questions
What is two-step verification?
Two-step verification means signing in takes two things: your password and a short code from something you physically have, usually an app on your phone. The code changes every thirty seconds. Someone who steals or guesses your password still cannot get in without your phone, which is what makes it worth the extra step.
Which authenticator app should a dealership use?
Any standard authenticator app works, such as Google Authenticator, Microsoft Authenticator or 1Password. Each person installs one on their own phone and scans the code shown in bkd.ai. Avoid putting the codes on a shared store device, because that brings back the shared-password problem two-step verification is meant to remove.
What happens if a salesperson loses their phone?
In bkd.ai a dealership admin can reset that person’s two-step verification from Team settings, and they set it up again on their new phone. For an admin’s own account, or someone who belongs to more than one dealership, the reset goes through bkd.ai support, so one store cannot remove protection another relies on.
Is two-step verification required in bkd.ai?
No, it is optional today and each person turns it on for their own login in Settings, under Sign-in security. Many stores start with managers, finance staff and anyone with access to the whole dealership, then ask the rest of the team to follow. Once it is on, every new sign-in asks for the code.