Two-factor authentication for anything that touches money

ManageFC is free to play, and during the open beta nothing can be bought with real money. But the game does have an economy: an in-game currency, cosmetic items you can collect and, later, trade. Anything that can be accumulated can be stolen, so in April 2026 we put a second lock on it.

Which screens need it

Two-factor authentication (2FA) became mandatory for the six screens where currency or items change hands: the wallet, the shop, the marketplace, the inventory, Eternal Cards and trades. Everything else — your squad, tactics, matches, finances — works with a normal login.

There is one refinement worth explaining. Reading is allowed, changing is not. The game lets you open those screens and look at your balance without a second factor, because showing a number is harmless. Any action that would move currency or items — a purchase, a listing, a transfer between accounts — is refused unless the account has 2FA switched on.

How it works for you

2FA in ManageFC uses the standard time-based codes (TOTP) that authenticator apps such as Google Authenticator, Microsoft Authenticator or 1Password generate. Setting it up takes three steps in the game's settings:

1. Ask for a new secret — the game shows a QR code and the same secret as text.
2. Scan it with your authenticator app.
3. Type the six-digit code the app shows. If it matches, 2FA is on.

When you enable it you also get one-time backup codes. Keep them somewhere safe, away from your phone: they are how you get back in if you lose the device. Without them, recovering an account means proving ownership to us by email, which takes days rather than minutes.

The rest of the account lock

2FA sits on top of the other protections every account has today (some of them arrived later, after the security review we ran in June):

• Passwords are stored only as one-way hashes.
• Sign-in and registration are checked by reCAPTCHA to keep automated sign-ups out.
• After five failed sign-in attempts in a row, the account is locked for fifteen minutes. A successful password reset unlocks it straight away.
• All traffic to the site is encrypted.

Why do this in a free game?

Because "free" does not mean "worth nothing" to the person who spent months collecting something. The economy in ManageFC is cosmetic — nothing you can hold gives you a sporting advantage, as we explain in cosmetics without pay-to-win — but collections still matter to the people who build them.

It was also easier to add 2FA early than later. Retro-fitting security to a game with a live economy means asking thousands of existing accounts to change how they log in. Doing it in April meant most players met it the first time they opened the wallet.

Next in the diary: why we deleted our battle pass.