EU Funding and Tenders Portal Two Factor Authentication 2026

By Aoba Works · Published October 22, 2026 · 17 min read

How this guide was made: drafted with AI assistance from the official sources linked below, then passed an automated editorial check before publishing. Our process

• Eu Login
• Funding And Tenders Portal
• Lear
• Horizon Europe

To pass two-factor authentication on the EU Funding and Tenders Portal, you add a second verification method to your EU Login account. The options are the EU Login Mobile App, a passkey, a security key, a "trusted platform" (the security chip already in your computer) or a national eID. Then you switch 2FA on under Security Settings. SMS codes no longer count, because EU Login phased them out on 30 June 2025. Since the 2026 rollout, the Commission has made 2FA mandatory for all Portal users, so you need it working before you can submit a proposal or manage a PIC.

Which option is right for you?

For most readers, the EU Login Mobile App plus one backup method is the best start. The table matches each situation to a method and the first page to open.

Why these picks: the Commission recommends the app because it supports biometrics and an offline QR code. A built-in trusted platform costs nothing. A security key is the only option that travels with you and doesn't depend on a phone battery.

What is EU Login and why does the Funding & Tenders Portal require two-factor authentication?

EU Login is the European Commission's shared sign-in service, and the Funding & Tenders Portal requires 2FA on it because Portal accounts control proposals, grant signatures and legal-entity data.

The Portal has no password system of its own. When you click Login on the Portal, you are sent to EU Login (webgate.ec.europa.eu/cas), and the same account works for other Commission services. Your 2FA settings live in EU Login, not in the Portal. That is why every setup step below happens under My Account in EU Login.

The Commission's stated aim is to "increase the level of data and account protection". The risk is concrete. A Portal account can submit a proposal on behalf of a consortium, accept a grant agreement or change an organisation's bank and legal data. When EU Login dropped SMS, it pointed to "phishing, SIM swapping, and message interception".

Example: suppose a research officer's password leaks through an unrelated website breach. Without 2FA, anyone holding that password could open the officer's draft proposals. With 2FA, the attacker would also need the officer's phone, security key or computer chip.

Pitfalls:

• Treating the Portal and EU Login as separate accounts. If you created two EU Login accounts (for example, a personal Gmail one and a work one), 2FA on one does not protect the other. Your Portal roles stay tied to whichever email they were given to.
• Assuming SMS still works. Old university guides still describe "Mobile Phone + SMS". That method was disabled by 30 June 2025.

How to set up two-factor authentication on EU Login step by step

You set up 2FA in EU Login under My Account: register one verification method, activate 2FA in Security Settings, then answer three security questions. The five steps below use the EU Login Mobile App, which is the Commission's recommended method. They follow the official installation guide and the Portal's IT How To page.

Before you start, have two devices ready: a computer with internet access and a phone or tablet. The phone must have a screen lock (PIN or biometrics). You will also need to allow the app to use the camera and send notifications (source). The minimum versions are Android 7.0 and iOS/iPadOS 12.0 (source).

Step 1: Install the app

1. Install EU Login from Google Play or the App Store. Check that the publisher is the European Commission.
2. Open it. On the Welcome screen, tap Link device to my account. The app then shows an overview of the registration steps.

Step 2: Open your account settings on the computer

1. Go to https://ecas.ec.europa.eu/cas and sign in with your email and password.
2. Click the cogwheel icon (or your profile avatar) and choose My Account.
3. Select Manage my mobile devices, then Add a mobile device.

Step 3: Name the device and set a PIN

1. Enter a device name without spaces. For example, Pixel8-work works but My work phone does not.
2. Choose a 4-digit PIN and confirm it. You will type this PIN on the phone at every login unless you turn on biometrics.
3. Submit. A QR code appears in the browser.

Step 4: Link the phone

1. On the phone, tap Continue and scan the QR code on the computer screen.
2. Enter the 4-digit PIN from Step 3.
3. Optionally turn on fingerprint, face recognition or Face ID. You can skip this and enable it later in the app's settings.
4. Tap Finish registration.

Step 5: Activate 2FA and set your security questions

1. Back in My Account, open Security Settings and click Activate.
2. Set up three security questions. Use Latin characters only and no special characters (source). Click Send Questions.

Write the answers down somewhere safe, such as a password manager note. These three answers are what let you remove or replace a lost method later. Without them, you have to contact the helpdesk.

Example of a login afterwards: you enter your password on the Portal, choose EU Login Mobile App PIN Code, and approve the notification on your phone with your PIN or fingerprint. If the phone has no data signal, choose the QR code option instead and scan the code from the screen.

Common mistakes and fixes:

• Space in the device name → the form rejects it. Use hyphens.
• Camera permission denied → the QR scan fails silently. Allow camera access for EU Login in the phone settings and scan again.
• Accents or symbols in the security answers ("Zürich", "O'Brien") → they break the Latin-characters rule. Use plain letters.

Which 2FA methods does EU Login support (authenticator app vs SMS vs EU Login Mobile app)?

EU Login supports its own Mobile App, passkeys, FIDO2 security keys, trusted platforms and national eID. SMS has been withdrawn, and generic authenticator apps such as Google Authenticator are not on the official list.

So the "authenticator app vs SMS" choice many people search for does not exist here. The real choice is between the methods in this table.

To add any method other than the app, go to My Account → Manage my Trusted Platforms, Security Keys and Passkeys. Then pick Add a Trusted Platform, Add a security key or Add a passkey, enter a device name and click Submit (source). With a security key, you touch the key when prompted. With a trusted platform, your computer asks for its usual PIN or fingerprint.

Which one to pick: if you have a smartphone, register the app first, because it covers almost every case. Then add the trusted platform on the computer you submit proposals from. Your backup is then free and needs no setup on the day you lose your phone.

Pitfalls:

• Passkey limits: you can store one passkey per EU Login account per device (source).
• Remote desktop: password-manager passkeys only work there if you can install the browser extension and the session has internet access (source).
• Adding a second method may ask for your first one. Adding a method "may require stronger authentication" once you already have a second factor, so keep the first device nearby.

How to recover access if you lose your 2FA device or phone number

If you lose your device, sign in with another registered method or answer your security questions to replace it. If you have nothing else, external self-registered users can wipe all methods with the PANIC button and start again.

Which path applies depends on what you set up beforehand.

Path A: you have a second registered method

1. Sign in with the backup method (trusted platform, security key or passkey).
2. Go to My Account → Manage my mobile devices and delete the lost device.
3. Add the new phone using Steps 1–4 above (source).

Path B: no other method, but you know your security questions

The Portal's IT guide says you can replace the method by answering your three questions. If 2FA is not mandatory for your account, you can also deactivate it this way (source).

Path C: the PANIC button (external self-registered accounts)

This follows the official EU Login help article:

1. Clear your browser cookies.
2. Open My Account and sign in with your email and password only.
3. Click Delete all my devices and eID (PANIC).
4. Confirm with Delete. You get a confirmation message and are logged out.
5. Sign in again and register a new method straight away.

PANIC removes every phone, device, hardware token and eID linked to the account. The button only appears once at least one 2FA method is registered.

Path D: nothing works

If you forgot the security questions, or you have an EU institution staff account, you need to request a reset. Use the Portal helpdesk contact form and select EU Login as the domain and Two-Factor Authentication as the category (source). For EU Login itself, write to EU-LOGIN-EXTERNAL-SUPPORT@ec.europa.eu (source).

Pitfalls:

• Losing the phone in the week of a deadline. The Commission does not publish a turnaround time for helpdesk resets, so don't plan around one. A free trusted-platform backup avoids the problem.
• "Always require multi-factor authentication". If you turned this setting on and then lose all factors, the password-only route disappears and you must contact support (source).

How to add or change a mobile phone number for EU Login authentication

Changing your phone number no longer affects EU Login 2FA, because SMS codes were withdrawn. What matters is the device: a new phone has to be linked again in Manage my mobile devices.

Older guides describe Manage my mobile phone numbers under My Account for external users (example guide). That screen was for the SMS method, which ended by 30 June 2025. A new SIM in the same handset has no effect on the app. A new handset is what breaks the link.

When you get a new phone (old phone still working)

1. Install the EU Login app on the new phone.
2. Sign in on the computer and go to My Account → Manage my mobile devices.
3. Choose Add a mobile device. EU Login asks you to confirm with the old device or another registered method (source).
4. Finish linking the new phone, then delete the old entry.

Do this before you wipe or trade in the old phone. Otherwise you are on the PANIC path described above.

Pitfalls:

• Restoring from a backup and expecting the app to carry over. It won't: the app must be re-registered after a reset or device change.
• Sharing one phone between colleagues. The current official guide says the app now supports multiple accounts. An older Commission page states one account per device, though. If a second account won't link, give that person a passkey or security key instead.

What to do when EU Login two-factor authentication is not working

Most 2FA failures come from a device that was never linked or was reset, missing permissions, stale cookies, or the wrong account. You can fix each of these without a full reset.

Go through this table before you contact the helpdesk.

Example: a consultant installs the EU Login app on a new phone and tries to log in at once. The Portal shows error 5305. The fix is to link the phone first under Add a mobile device, confirming with the old phone. If the old phone is gone, use PANIC.

The Commission also published a one-page 2FA infographic covering eight common situations, including device loss and error 5305. It ran a practical webinar on 13 May 2026 (source). Keep the infographic open while you troubleshoot.

Pitfall: don't delete and reinstall the app as your first move. If the app is your only method, a reinstall cuts the link, and you end up on the PANIC path.

How does EU Login 2FA affect PIC registration and organisation account setup on the Funding & Tenders Portal

Every Portal login now needs 2FA, so the person registering the organisation, and later the LEAR, must set up 2FA before starting PIC registration. Without it, they can't reach the Participant Register.

The Online Manual still says you only need an EU Login account to start registering. It doesn't mention 2FA, because it was written before the rollout. In practice, the order is now:

1. Create the EU Login account with a work email. All Portal roles attach to that address.
2. Set up 2FA (the five steps above) and add a backup method.
3. Register the organisation in the Participant Register to get the 9-digit PIC. It starts as provisional, "declared/non-valid status". Our PIC registration guide covers this part in six steps.
4. Validation and LEAR appointment. Validation must come first; the LEAR is appointed after it (LEAR page). The LEAR also needs their own EU Login account with 2FA.
5. Assign Account Administrators and signatories. Every person the LEAR adds will hit the same 2FA prompt on their first login.

Example: a five-person startup preparing an EIC Accelerator application. The founder self-registers the company, and the CFO becomes LEAR after validation. If the CFO's only factor is the app on a phone they are about to replace, the company's single LEAR could be locked out just before grant signature. Having each of them add a trusted platform as well removes that risk.

Pitfalls:

• Registering the PIC under a personal email and then moving to a work email. The roles stay on the old account, along with its 2FA.
• Leaving 2FA setup for submission day. Partners in a consortium all need working access to the proposal. If you're coordinating a two-stage health call such as HORIZON-HLTH-2027-02-TOOL-01, ask every partner contact to confirm their 2FA when the consortium forms.

Is two-factor authentication mandatory for all EU Login users or only certain roles

Yes, it is mandatory for all Funding & Tenders Portal users, not only LEARs or signatories. The Commission rolled it out in batches and finished on 30 June 2026.

The Portal's IT guide states that 2FA becomes mandatory for all users during 2026. The timeline as of October 2026:

The scope is wide: researchers, evaluators and organisation staff in any EU programme. Browsing calls without signing in is still open to everyone, so you can search for SME calls without an account. 2FA starts the moment you click Login.

Pitfall: other Commission applications that use EU Login have their own rules. A service that still accepts your password alone doesn't mean the Portal will. Set 2FA up once at account level and it covers both.

Next steps

Today, you can finish the setup and add a backup method on your own in under an hour. If you'd rather have help, free official support comes first.

DIY actions for today:

1. Install the EU Login app and complete the five setup steps, including the three security questions.
2. Add a second method under Manage my Trusted Platforms, Security Keys and Passkeys. The trusted platform on your main computer is free.
3. If you are a LEAR or self-registrant, confirm that your Portal roles sit on the same work-email account that now has 2FA. Then ask each Account Administrator to do the same.

If you'd rather not do it yourself:

• Commission helpdesk and infographic (free). The contact form and the 2FA infographic suit anyone who is stuck. The limitation: no published response time, so they're not a deadline-day rescue.
• Your National Contact Point or university research office (usually free to applicants). Good if you're new to the Portal. They can't reset your EU Login, though; only the Commission can.
• Paid grant consultant. Fees vary widely and are usually charged as part of proposal support (as of October 2026; check each provider's terms). This makes sense if you're buying help with the proposal itself, such as Part B scoring. Paying someone only for 2FA setup is poor value. Also, never give a consultant your EU Login password or device: the account is personal and tied to your legal role.

Related guides on this site:

• EU Funding and Tenders Portal Registration: PIC in 6 Steps
• EU Funding for SMEs: 7 Open 2026 Calls and How to Qualify
• Cascade Funding Open Calls: Portal Filters and 2026 Dates

FAQ

Can I use the same EU Login 2FA setup for other EU portals besides Funding & Tenders?

Yes. 2FA is set on your EU Login account, not on the Portal, so any Commission service that signs you in through EU Login uses the same registered methods. Some services restrict which methods they accept, so a method that works on the Portal may be refused elsewhere (source).

What happens if my organisation's LEAR changes and loses 2FA access?

A LEAR's 2FA is personal and can't be handed over. If the LEAR is still with the organisation but has lost their device, they recover through a backup method, the security questions, PANIC or the helpdesk. If the LEAR has left, the organisation appoints a new one through the LEAR appointment procedure. The new LEAR then sets up 2FA on their own EU Login account.

Does EU Login 2FA work without a smartphone?

Yes. You can use a trusted platform (a PC with a TPM chip or a Mac with Secure Enclave), a FIDO2 security key, a passkey stored in a password manager, or a national eID where available (source). SMS on a basic phone is no longer an option.

How long does EU Login account recovery take after losing 2FA access?

With a backup method or PANIC, recovery is immediate: you remove the old device and register a new one in the same session (source). If you need a helpdesk reset because you forgot your security questions, there is no published turnaround time. Set up a backup method well before any call deadline.

Sources

• Two-factor authentication in the Funding & Tenders Portal – IT How To (European Commission)
• How can I add a mobile device to my EU Login account? – EU Login Portal
• How can I add a Security Key or a Trusted Platform? – EU Login Portal
• Passkey in EU Login – EU Login Portal
• Phase out of EU Login authentication using SMS – EU Login Portal
• SMS Multifactor Authentication to Be Disabled by 30 June 2025 – F&T Portal news
• Protecting Your Data: Mandatory 2FA for Experts! – F&T Portal news
• An application requires a second factor authentication, but I do not have access to it anymore – EU Login Portal
• I reinstalled the EU Login mobile app and/or my device is broken, was stolen or I replaced it – EU Login Portal
• EU Login Most Common Issues – EU Login Portal
• F&T Portal FAQ on error 5305
• 2FA infographic – European Commission
• F&T Portal helpdesk contact form
• Set up Two-factor authentication with the EU Login Mobile app – Digital Building Blocks
• Registration and validation of your organisation – F&T Online Manual
• LEAR appointment and validation – F&T Online Manual
• Update on the rollout of mandatory 2FA for EU Login accounts – UKRO
• Two-factor authentication in the EU Funding & Tenders Portal – University of Siena
• Mandatory 2FA in the Funding & Tenders Portal: Be Prepared – Horizont Evropa (CZ)
• EU Funding & Tenders Portal: get ready for two-factor authentication – MMU research blog

Spotted something out of date or wrong? Tell us at shigoto.ai.note@gmail.com. Guides are re-checked against official sources on a rolling schedule.