What is MFA?
Multi-Factor Authentication (MFA) or Two-Factor Authentication (2FA) is an essential security feature that adds an extra layer of protection to your Built account. It helps prevent unauthorized access and fraud by requiring users to verify their identity through a secondary method beyond just a password. Built has adopted a "most-protective" approach to security in compliance with state regulations and to better safeguard user information and payment transactions.
As a Builder or Borrower, you can manage Multi-Factor Authentication (MFA) within your account settings and change the setup method as needed. Follow the step-by-step process below to manage MFA for your own account within Built.
How to Enable MFA
Locate the Settings icon in your navigation bar

Navigate to the Account Settings section in your user profile

Locate the Multi-Factor Authentication (MFA) Section
If MFA is not enabled, you will see a “Set Up” button
Click “Set Up”
A window will open, prompting you to choose your preferred MFA method
Choose Your Method
SMS: Receive a verification code via text message
Authenticator App: Use an app like Google Authenticator to receive a verification code
Follow the steps to complete verification of your chosen method
Once verified, you’ll see the method chosen as Enabled

Multi-Factor Authentication is now active and will be required the next time you sign in
Setting up SMS
Enter Your Mobile Number
Select your country code
Enter your phone number
.png?sv=2022-11-02&spr=https&st=2025-10-24T16%3A45%3A04Z&se=2025-10-24T16%3A59%3A04Z&sr=c&sp=r&sig=dRe8I07%2FyfeUkjs7MKmmouX7%2FuWpCWXM5O574Gmmgm0%3D)
Click “Send Verification Code”
You’ll receive a text message with a 6-digit code
Enter the code in the open text field provided
Click “Verify”
You’ll see confirmation that MFA via SMS is now enabled, along with a semi-hidden/masked version of your phone number

Multi-Factor Authentication is now active and will be required the next time you sign in
Setting up an Authenticator App
Open your preferred authenticator app on a mobile device or iPad/tablet
Scan the QR code shown on your screen within Built

Type in the one-time code generated by the app
Click “Verify”
Once verified, you’ll see MFA listed as Enabled

Multi-Factor Authentication is now active and will be required the next time you sign in
Note:
When setting up an authenticator app make sure you are logged in to Built on a desktop or tablet. The only option to setup via authenticator app is to scan the QR code that is generated in Built.
How to edit your MFA method after setup
Once MFA is set up, you can change your MFA method. Follow the instructions below to toggle between SMS and an Authenticator App, as preferred:
Locate the Settings icon in your navigation bar

Navigate to the Account Settings section in your user profile

Locate the Multi-Factor Authentication (MFA) Section
Click “Edit”

A window will open, prompting you to choose your preferred MFA method
Choose Your Method
SMS: Receive a verification code via text message
Authenticator App: Use an app like Google Authenticator to receive a verification code
Follow the steps to complete verification of your chosen method
Once verified, you’ll see the method chosen as Enabled

Multi-Factor Authentication is now active and will be required the next time you sign in
Note:
Once MFA is set up, you can change your MFA method at any time from your account settings. Reach out to Support for assistance if you are unable to do so following the steps above.
MFA Troubleshooting and FAQs
Is MFA required for every user?
Yes, MFA will be enforced for every user, both on the Built Inspect App (versions 4.0.16 and above) and on Built Desktop upon each login session.
Is MFA required on each login session?
Yes, MFA will be required upon every login. However, if you are using the same device, enable the "Remember this device?” option when logging in through your MFA method. With device memory enabled, you will only need to use MFA to log in every 90 days. Note: if you switch devices, you will need to re-enable MFA on your new device.

What MFA authenticator app can I use?
You can use any MFA authenticator app you prefer. Built recommends Google Authenticator, Microsoft Authenticator, or Duo Mobile as the most popular options.
Do I have to set up MFA again if I change my phone number?
If you have selected SMS as your authenticator method and change your phone number, you will need to re-enable MFA. Contact Built Support for assistance.
Can I log in with MFA even if I don’t have cellular service?
If you have selected SMS as your authenticator method, service will be needed to receive a text message. For this reason, Built recommends choosing an Authenticator App for any users who may use Built when out of service areas (ie, Built Inspectors)
Can I use both SMS and Authenticator App methods?
No, currently MFA setup requires users to choose one method. However, the method chosen can be changed at any time. See How to edit your MFA method after setup above.
If I login through Single Sign-On, do I also need to enable MFA?
No, users who login through Single Sign-On (SSO) enforcement are not required to use MFA as well. Learn more about Single sign-on here.
What if multiple people use the same email address (account) to login to Built?
Shared credentials are generally not recommended for security reasons, however, this may be standard practice for some organizations. If multiple people use the same account in Built, setup MFA using the Authenticator App method only.
Can I receive an MFA code through my email?
No, currently the available MFA methods are SMS and Authenticator App’s only.
Do I need a QR code every time I login through MFA using an Authenticator App?
No, the QR code that displays is only for setting up MFA through the Authenticator App. Once MFA is enabled, users login through the code displayed within the Authenticator App.
How long are MFA codes valid before they expire?
Authenticator app codes (e.g., Google Authenticator, Authy): These typically expire every 30 seconds, which is standard for time-based one-time passwords (TOTP).
SMS codes: These are valid for up to 3 minutes after they are sent.
