Account & Security

Account security & 2FA

Enabling two-factor auth, changing your password, and how we detect suspicious sign-ins.

SA Fashion Mall accounts hold money in escrow. Take a minute to lock yours down — the tools below take five clicks total.

Turning on 2FA

Open /account/security → Two-factor authentication.
Scan the QR with Google Authenticator, 1Password, Authy or any TOTP app.
Enter the 6-digit code to confirm and save your backup codes somewhere safe.
Every future sign-in from a new device requires both your password and the 6-digit code.

Changing your password

From /account/security → Change password. Passwords must be at least 10 characters with mixed case and a number. Password changes revoke every existing session — you'll be signed out of all other browsers and devices immediately.

How we detect suspicious sign-ins

Every login records IP → city/province, device fingerprint hash, and user-agent.
Sign-ins from a new city trigger a step-up verification email (magic link) before the session activates.
Multiple failed password attempts (5+) in a short window lock the account for 30 minutes; email notification fires.
The audit log tracks the last 20 logins — visible on /account/security → Recent activity.

Admin accounts have 2FA mandatory (can't be disabled). Sellers with a live escrow balance should have 2FA on — it takes 60 seconds to set up and eliminates the risk of a hijacked payout.

Still need help?

Contact support about this