What to Do if You Are Locked Out

Getting locked out of your account can be frustrating, especially when you have payments to manage. Because Procore Pay handles sensitive financial transactions, multi-factor authentication (MFA) is strictly enforced to protect your data.

If you are currently locked out of your account, follow the troubleshooting steps below to regain access:

Once you have submitted your recovery request or regained access, explore these resources to minimize business disruption and protect your account moving forward:

Troubleshooting Missing Verification Codes

If you are not receiving your MFA codes, or if you switched devices and cannot find your authenticator app setup, the codes may be hidden or automatically stored on your device.

SMS Verification Issues

If you are authenticating via SMS text message and the code is not appearing in your primary inbox, it may have been flagged as spam by your mobile operating system:

  • On iPhone (iOS): Open the Messages app and tap Filters in the top-left corner. Check the separate folders labeled Unknown Senders or Unknown & Junk.

  • On Android: Open the Messages app, tap the three dots (More options) in the top-right corner, and select Settings > Block numbers and spam.

Authenticator App Issues

If you use an authenticator app, your device may have automatically configured and saved your MFA credentials via an operating system scan when you first set it up:

  • On iOS: Check the native Passwords application in your iPhone settings to see if a verification code generator is active for Procore.

  • On Android: Check the Google Authenticator app or your Google Account settings to verify if the account credentials were automatically saved.

Look for Your Recovery Code

During your initial Procore Pay MFA setup, you were provided with a 24-character Recovery Code and instructed to save it in a secure location.

  • Search your files, password managers, or physical notes for this code.

  • If found, you can use it directly on the login screen to bypass the MFA prompt and reset your authentication device.

Check for Automated Backups

If you lost your authenticator app or switched phones, your accounts might still be backed up.

  • Android Users: If you used Google Authenticator, check to see if the app automatically backed up your credentials to your Google Account when you first scanned the QR code.

  • iOS Users: Check if your authenticator app (like iCloud Keychain, Microsoft Authenticator, or Authy) synced with your iCloud backup.

Contact Another Payee Administrator

Do you have another colleague with Payee Admin permissions in your company?

  • If yes: Reach out to them immediately. Any other Payee Administrator within your organization can reset your MFA settings directly from the user management dashboard, allowing you to log in and pair a new device.

  • If no: Reach out to Procore Support—and please review the security guidelines below.

Mandatory Security Protocols for Payee Admins

If you are the only Payee Administrator for your account and do not have your recovery code, your request must undergo a strict security review.

  • No Guarantee of Reset: Because Procore cannot verify your identity over the phone or via simple email for financial tools, these requests are reviewed on a strict, case-by-case basis. Procore reserves the right to deny manual reset requests if identity cannot be sufficiently verified. If a standard MFA reset is not possible, our security team will work with you to complete alternative, high-assurance identity verification methods to restore secure access to your account. Access to Procore Pay features will always remain contingent upon maintaining active, compliant authentication protocols.

  • Timeline: The mandatory security review process takes 4 to 6 business days. This timeline is mandatory to allow our security teams to thoroughly investigate and prevent fraudulent takeover attempts. Procore Support cannot expedite this process. Procore assumes no responsibility or liability for delayed financial transactions, missed deadlines, or business interruptions resulting from security lockouts or the time required to complete a security review.

While You Wait: Managing Business Continuity

If you are facing a strict deadline while your account is locked or under review, you must coordinate directly with your General Contractors (GCs):

  1. Request Alternates: Ask your GC if they can help you onboard a temporary secondary user from your company to access relevant items.

  2. Manual Data Entry: Work with your GCs to see if they can manually input any urgent invoice data or documentation on their end to keep your projects moving forward.

Best Practices to Prevent Future Lockouts

To ensure you never lose access to Procore Pay again, implement these security habits:

  • Assign Multiple Payee Admins: Always ensure your company has at least two trusted individuals designated as Payee Administrators. This allows for instant, self-service MFA resets if one person loses their device.

  • Stop Account Sharing: Sharing a single login among multiple users is the leading cause of MFA lockouts (as the authentication device is tied to one person's phone). Every individual must have a unique, 1-to-1 user account. If multiple people need access, work with your GCs to ensure everyone is invited to the project individually.