Two-factor Authentication is for both you and your company’s online safety and security. It is a requirement in many countries across the globe, and a commitment we made to our clients to bring @ Work up to industry regulatory standards.

You can; however, it is not recommended. Enrolment is a quick and easy process and should only take a moment of your time. Once you are prompted to enrol, simply verify that the prepopulated data (name, email) is correct, create a numeric security code between six and nine digits (mandatory), and provide your mobile number (optional). If you close the enrolment window without completing it, you will be prompted to enrol every time you log in. If your prepopulated data is not correct, please contact your local PA Servicing Team to help update it.

Behind the scenes, the system that enables two-step authentication needs to create a profile for you. The security code will enable American Express to retrieve your account credentials (User ID and password) should you forget them or lock yourself out of the system. Additionally, having a mobile phone number on file is for your convenience only and is not mandatory. It will allow you to choose how you want to receive your one-time password for two-step authentication. If you choose not to provide one, your one-time password will always be sent to your business email address.

That depends. You will have the option to remember the trusted device you are using to log in with. If you choose to remember your device, that trusted device will serve as your identity verification for future logins ̶ you will input your User ID and password and be sent directly to the

@ Work homepage, until the time when you are prompted to

re-authorise your device. If you choose not to remember your device, or if you sign in from a different device, you will be sent a one-time password every time you log in and continue with the standard

Two-factor Authentication process.

Your Two-factor Authentication (TFA) will be initiated based on the primary market you manage as part of your @ Work profile. Once you are enroled for TFA, you will be authenticated at login regardless of which market you are managing. For example, if Singapore is your primary market but you also manage a programme in the US and Mexico, then you will be enroled into TFA when Singapore launches.

However, if the US is your primary market and you manage Singapore and Mexico, if Singapore has launched TFA but the US hasn’t, you will not be enroled in TFA until the US is enabled. Prior to you logging in, we determine your location by your browser. Once you log in, you will be redirected to your primary market, and will only receive TFA if that market has been enabled with the new capability.