Multi-factor authentication to access My Service Canada Account with GCKey

For more information, read the following questions and answers:

General questions

What is multi-factor authentication? Is it mandatory?

Multi-factor authentication is an enhanced security measure. It helps protect your personal information for My Service Canada Account (MSCA). It is an alternative security feature to help prevent unauthorized access to your account.

At this time, the multi-factor authentication registration is not mandatory. GCKey users will have the option to register for multi-factor authentication.

Why is multi-factor authentication being introduced for GCKey?

The Government of Canada faces ongoing and persistent cyber threats. Enhanced security measures are introduced to access MSCA. The multi-factor authentication is an alternative security feature for MSCA clients using GCKey. It does not affect those who sign in with their bank or their provincial digital ID.

How do I register to multi-factor authentication?

To register, you must successfully respond to your existing security questions. You will then need to choose between the following 3 options:

  • provide a smartphone number to receive a security code by SMS
  • provide a phone number to receive a voice message
  • use an authenticator app (free of charge) that generates a security code
Is multi-factor authentication replacing other security features currently in place?

The mandatory security questions will not be required anymore for GCKey users who register for multi-factor authentication.

Can I disable the multi-factor authentication feature?

A reset option is available if you:

  • lost your device
  • got your device stolen
  • changed your phone number
  • deleted or re-installed the authenticator app
  • no longer want multi-factor authentication
What does it mean when I see "Standard message and data rates may be charged by your service provider”? Is there a charge to receive the security code?

Employment and Social Development Canada does not charge for this service. Your service provider may charge standard message and data rates. Contact your service provider for questions about your plan and costs.

Smartphone or landline users

How does multi-factor authentication work if I use a smartphone or landline?

After answering your 3 security questions, you will then need to provide a smartphone or a landline phone number. A security code will be sent to that number via SMS or voice message. You will then be required to enter the security code to confirm your identity. Once confirmed, you will have access to MSCA.

You will have to enter a new security code each time you access MSCA with GCKey.

What if I didn’t receive a security code?

If you did not receive a security code, you can ask for it to be resent. You can request it 3 times before your session is terminated during the multi-factor authentication registration. Once registered, you can request it 5 times before your account is locked. A security code can be requested every 2 minutes and each code expires after 5 minutes.

Can I use an international phone number to receive a security code with the multi-factor authentication?

At this time, only North American phone numbers can receive a security code.

What should I do if I have been locked out of my account?

If your account is locked due to entering the wrong security code or requesting it too many times, please contact our Registration and Authentication Help Desk at 1-866-279-5238. The hours of operation are from 8:30 a.m. to 4:30 p.m. local time, Monday to Friday, except civic holidays.

Authenticator app users

How does multi-factor authentication work if I use an authenticator app?

After answering your 3 security questions, you will then open an authenticator app on your device. If you don’t have one, you can download an authenticator app that you trust. These apps are available through the application store on your device.

Once the app is opened, you will need to scan the QR code from the multi-factor authentication registration screen. Your new Government of Canada account will automatically be added to the app. It will be displayed as Canada.ca (MSCA user xxxxxx). The app will generate a security code that you will enter to confirm your identity. Once confirmed, you will have access to MSCA.

You will have to enter a new security code each time you access MSCA with GCKey.

How secure are authenticator applications?

You should choose an authenticator app that you trust through the application store on your device. You should always read and understand its terms and conditions and/or notices before installing the app.

Authenticator apps are well established in the industry, and their use is secure. No personal information is shared between authenticator apps and the Government of Canada.

Report a problem or mistake on this page
Please select all that apply:

Thank you for your help!

You will not receive a reply. For enquiries, contact us.

Date modified: