MyBell and email MFA/2FA access

[Psych_1967]

I understand that you may call these "annoyances" but for your elderly customers and those with brain injuries or dementia, these are more than annoyances-they are disabling. They are cutting them off from their loved ones-because many of your customers live alone or with people who are unable to help them and they may rely on their adult children, who may live oversees-in a different time zone, to receive codes *for* them, etc. The time difference can be a huge problem. Logistically, it is unreasonable of Bell Canada, or any other email provider to expect those with dementia and cognitive challenges to be able to navigate two factor authentication.  

[Old Guy98]

This is my exact situation.  This MFA is ridiculous. Bell do better.

[BellAlexander · Accepted solution]

Thank you @Psych_1967 and @Old Guy98  for sharing your feedback. You are correct that for elderly customers, those with cognitive challenges or individuals relying on remote caregivers, Multi-Factor Authentication (MFA) can feel like a disabling barrier rather than a minor inconvenience. We understand the frustration and how difficult a change like this can be. The decision to implement MFA across Bell platforms was not taken lightly and was done to enhance customer protection and fraud prevention.

Here is why this security protocol is required

Cybercriminals and fraudsters disproportionately target seniors and vulnerable individuals through phishing scams and account takeovers. Without MFA, a compromised password gives a malicious actor complete access to a user's personal communications, billing details, and identity. MFA first and foremost acts as a critical shield to prevent this.

Industry & National Security Standards

The implementation of MFA aligns with stringent cybersecurity protocols recommended by national authorities, such as the Canadian Centre for Cyber Security. As threats evolve, email and service providers alike are universally moving away from password-only logins to ensure user data is not compromised.

Ways to Minimize MFA Prompts

While we cannot disable MFA on an individual account basis, there are ways to set up email so that a user does not have to authenticate every single time:

Use an Email Client (App)

Setting up your Bell email or any email service on an application like Apple Mail, Microsoft Outlook, or the native Mail app on your tablet and phone is the best workaround. Once the account is linked to the app, it bypasses the daily MFA requirement that you experience on the web browser. See Using Bell Email for steps on setting up your email on an iOS, Android or desktop email client using IMAP. We recommend using IMAP because it provides useful functions, such as syncing your folders and messages across multiple devices.

"Keep me signed in"

If using a web browser is your only option and if available; check the "Keep me signed in" box and verify that the browser's privacy settings are not set to clear cookies when closed.

To learn more about how you can protect yourself online we encourage you to read our other articles in the Safety & Security How To section, articles from GetCyberSafe.ca and visit Bell.ca/security for more information.

[Datastreamer]

Multi-Factor Authentification is a too much of a cellphone/email concentrated evolution, where everything is dependant on a PIN being sent to the phone number/email supplied. Admittedly, MFA is a necessary evil for many different logins. I think your IT types should consider a personal  4-6 digit PIN to allow access to your personal mail. When it comes to a cellphone, a biometric finger print verification has been around for years and would expedite the frustration of waiting for  the PIN to present itself on an occsionally busy cellular network. The methodology is somewhat "redundant" in 2026 when biometrics is being adopted on many cellphone apps.

[dks]

Thank you for your comments. With the overwhelming majority of Canadians having cellphones, MFA makes sense. Some MFA options also include a phone call back or other ID. It is a significant fraud prevention method. 

[ComptechCD]

I'm reaching out here on behalf of two customers as I've run into the same runaround twice now with your support team, and I'm hoping I can get some resolution for myself and other users facing the same issue.

Currently, as many are aware, Bell is enforcing 2FA/MFA on any web-based logins. Fantastic, great, they and I understand why and how it works. The problem my customers have been facing, now that it is strictly required and no longer 'skippable', is that they're now being asked to provide authentication codes from their app whenever they log into Bell webmail - an app they never setup, installed, or configured in any way before. There is no other option to use email or phone for the code, it SPECIFICALLY SAYS to use the code from the authenticator app, and NO CODE is emailed or texted to the customer's contact information as configured in their MyBell.

Now, I have thoroughly investigated all their devices to ensure there is, in fact, no authenticator app setup for them (and of course they are certain it never was, because they don't even know how to do it), and in lieu of any other options, I reached out to Bell's support team... which was less than helpful.

They gave me the reasons why it has to be on, why it can't be bypassed, etc. (and again I understand), however when I tried to explain to them that there was no authenticator app involved, and the webmail login SPECIFICALLY AND ONLY asks for that authenticator app code, they just kept assuring me that a code would be emailed and it would just work. I left it at that, and tried to login, expecting a code to come.

There was no code emailed. Ever. I control the server that sends and receives email for one of those customers, where the code would be sent, and they got 0 emails from Bell over the course of the following week.

My question is, why is Bell turning on an authentication method WITHOUT the customer setting it up? How are they supposed to even configure an auth app if they CAN'T EVEN LOGIN? Why is this the default??? Why can't the customer choose another auth method if one of them isn't available? You obviously support multiple, according to your own documentation - which DOESN'T EVEN MENTION using an authenticator app AS an option, so I don't even know why it's even asking. Some insight would be appreciated, as both customers RUN A BUSINESS through their emails WITH YOU, and only being able to access it through a third party client is untenable, ESPECIALLY when right not they're considering their account compromised - but I can't even check if there's some malicious mail forward involved because NO ONE can long into the webmail!

[ComptechCD]

Bundling my question in with this one doesn't resolve the issue.

Your system is fundamentally broken, and people are having money stolen out of their bank accounts because of your ineptitude. You have a setup for randomly generated codes via a user-installed app, that isn't even documented nor supported by you officially and regardless of whether the user even has said app, yet your webmail login demands it if a user has never set up their 2FA/MFA before. There is 0 options to choose another MFA method, even if the user has those options setup. This is ridiculous - and here, I'll attach a photo of that message since you seem to think this is just some misunderstanding of your broken system.

MFA "Error" Page

No options to choose another MFA method, clearly, and I can easily replicate this just by logging in. It is literally impossible to login - and I've replicated this on multiple different computers, so don't try to weasel your way out of this by saying 'oh use a different browser, clear your cookies', because here's the same message in Incognito mode, with all my browser extensions turned off. Edit: Not sure why you felt the need to delete this photo, it has been scrubbed and is to prove a point.

Incognito Mode

In other news, I was able to get this through to your support team over the weekend, who assured me and the customer that 'within 24 hours' they would remove the authenticator app requirement and allow them to setup/use a different MFA method, and that they would call the customer when it was ready. They never called. Get your act together, Bell.

[BellNick]

Hi @ComptechCD 
Thank you for your post and welcome to the Community.
We'd like to take a closer look into this and have sent you a private message.
Please check your Messages within your profile avatar in the top right corner.
Unsure how to check or send a private message? See How to send a private message