Skip to main content

Solutions

Law firms

Tax, audit & accounting firms

Corporations

Governments

Products

Legal

Trade & supply

Tax, audit & accounting

Corporate tax

Risk & fraud

Books

Recommended products

Questions? We are here to help.
Contact us

Purchase

Buy solutions

Buy books

Contact sales

Questions? We are here to help.

Resources

Insights

Events

Product training

Product communities

Developers

Thomson Reuters Account

Security changes to the Thomson Reuters account

The Thomson Reuters Account is introducing security updates in late 2025 and 2026 to strengthen two-factor authentication (2FA).
In our continuing effort to make the Thomson Reuters Account the safest, most secure, and easiest to use identity system available, key changes were introduced over the last few months of 2025.

Deprecating email as a standard 2FA option

From November 14, 2025, email is no longer available as a standard 2FA option for Thomson Reuters products. Since a verified email address is the Thomson Reuters Account primary identifier, email has been removed as a 2nd factor. Use another two-factor authentication option to secure your account.
note
This constraint applies to products that use an email address and password with two-factor authentication (2FA) at sign in. Customers who use a single sign-on with their company credentials won't experience any change.

The Thomson Reuters account and 2FA

By now, everyone is familiar with two-factor authentication (2FA) and how important it is to protect your online activities. The Thomson Reuters Account grants its users flexibility in using 2FA. By default, you don't need to enroll in 2FA simply to have a Thomson Reuters Account. However, you may access certain products that deal with confidential and private data and to ensure that bad actors use your account to access that data, you will be required to enroll in 2FA to access those products and services.

Available factors

The Thomson Reuters Account offers several other excellent alternatives and we recommend enrolling multiple factors to ensure that you are never caught in a situation where you can't gain access to your account.
  • Biometrics:
     You may be able to register a device's biometric sensor as a convenient 2nd factor. This is a very quick and easy way to provide your 2FA challenge and is highly recommended.
    note
    Be aware that Thomson Reuters never receives or stores your biometric data. Your device validates your biometric information on its own hardware and sends Thomson Reuters only a certification that your device verified your identity.
  • Auth0 Guardian app (smartphone app):
     This is our recommended solution as the Thomson Reuters Account is built on the Auth0 platform, an industry-leading, enterprise-grade identity system. It integrates seamlessly with the Thomson Reuters Account, giving you a security challenge using push notification, and without the need to enter any codes into any challenge screens.
  • TOTP Authenticator Apps:
     Temporary One-time Passcode (TOTP) authenticator apps, like Google Authenticator and Microsoft Authenticator (and Auth0 Guardian, too!) Let you register the app as an authorized security-code generator to verify your identity at sign-in. These apps don't need to be run on a separate smartphone or device; they can be installed within a browser or on a desktop as well.
  • Phone:
     A popular option is to receive a single-use code via SMS or Voice. You can register a phone number to receive these codes and a preference to receive the code via SMS (preferred by many for devices) or Voice (preferred by many for landlines or for accessibility concerns).
  • Security Keys:
     WebAuthn Roaming authenticators are a relatively new security standard that lets users use a low-cost, non-network, cryptographically signed "key" to verify your identity. Yubikey is one of the most familiar vendors of these keys.
  • Recovery Code:
     The recovery code is a "recyclable" code that you should keep in a secure but readily available location for emergency use. If you are unable to access the factors that you normally use for 2FA, the recovery code is the most reliable way to gain access to your account, keep it somewhere close with your other security contingencies because you will need it when you least expect it.

Account recovery support

If for any reason you are unable to gain access to your account because you have lost all access to all of your authenticators, contact your customer support experts. After comprehensive identity verification, they’ll be able to help you regain access to your account, after which you should immediately visit Thomson Reuters Account and review your 2FA enrollments.

This article applies to:

  • Product: Accounting CS,Accounting CS Client Access,Account management,Engagement Manager,Fixed Assets CS,Practice CS,UltraTax CS,Virtual Office CS,Workpapers CS
  • Subject: Two-factor authentication