Security changes to the Thomson Reuters Account
In our continuing effort to make the Thomson Reuters Account the safest, most secure, and easiest to use identity system available, we will be introducing several key changes over the last few months of 2025.
Deprecating email as a standard 2FA option
Starting on November 14, 2025, email will no longer be available as a standard 2FA option. Since a verified email address is used as the Thomson Reuters Account primary identifier, we will be removing email as a second factor from the list of available factors you can use to ensure that your account is secure.
Resetting biometric and security key 2FA factors
On 14 November 2025, Thomson Reuters will be resetting customers" biometric and security key enrollments for 2FA. This reset is necessary for Thomson Reuters to make a required configuration change.
To ensure that you do not lose access to your Thomson Reuters Account following this reset, please visit Thomson Reuters Account and review your 2FA enrollments. We recommend enrolling in at least one additional factor such as the Auth0 Guardian App or a TOTP Authenticator App. Also, please ensure that your recovery code is stored in a safe and accessible place so that it can be retrieved at a time of need.
Once the reset is completed, the next time you sign in on a device that supports biometric 2FA authentication, you should be offered the opportunity to re-enrol that device again. Similarly, if you use a Yubikey or compatible WebAuthn security key, you can re-register that factor after 1 November 2025 at Thomson Reuters Account.
The Thomson Reuters Account and 2FA
By now, everyone is familiar with two-factor authentication (2FA) and how important it is to protecting your online activities. The Thomson Reuters Account allows its users flexibility in using 2FA. By default, you do not need to enrol in 2FA simply to have a Thomson Reuters Account. However, you may access certain products that deal with confidential and private data and to ensure that bad actors use your account to access that data, you will be required to enrol in 2FA to access those products and services.
Available factors
The Thomson Reuters Account offers several other excellent alternatives and we recommend enrolling multiple factors to ensure that you are never caught in a situation where you cannot gain access to your account.
- Biometrics:You may be able to register a device"s biometric sensor as a convenient second factor. This is a very quick and easy way to provide your 2FA challenge and is highly recommended. Please be aware that no biometric data is ever shared with Thomson Reuters. Your biometric data is validated on your device"s hardware and we are only ever sent a certification that your identity has been confirmed by your device"s hardware.
- Auth0 Guardian app (smartphone app):This is our recommended solution as the Thomson Reuters Account is built on the Auth0 platform - an industry-leading, enterprise-grade identity system. It integrates seamlessly with the Thomson Reuters Account, allowing you to acknowledge a security challenge using push notification, and without the need to enter any codes into any challenge screens.
- TOTP Authenticator Apps:Temporary One-time Passcode (TOTP) authenticator apps, like Google Authenticator and Microsoft Authenticator (and Auth0 Guardian, too!) allow you to register the app as an authorised security-code generator to verify your identity at sign-in. These apps don"t need to be run on a separate smartphone or device; they can be installed within a browser or on a desktop as well.
- Phone:A popular option is to receive a single-use code via SMS or Voice. You can register a phone number to receive these codes and a preference to receive the code via SMS (preferred by many for mobile devices) or Voice (preferred by many for landlines or for accessibility concerns).
- Security Keys:WebAuthn Roaming authenticators are a relatively new security standard that allows users to use a low-cost, non-network, cryptographically signed "key" to verify your identity. Yubikey is one of the most familiar vendors of these keys.
- Recovery Code:The recovery code is a "recyclable" code that you should keep in a secure but readily-available location for emergency use. If you are unable to access the factors that you normally use for 2FA, the recovery code is the most reliable way to gain access to your account - keep it somewhere close with your other security contingencies because you will need it when you least expect it!
Account recovery support
If for any reason you are unable to gain access to your account because you have lost all access to all of your authenticators, please contact your customer support representatives. After comprehensive identity verification, they will be able to help you regain access to your account, after which you should immediately visit Thomson Reuters Account and review your 2FA enrollments.