Security · Sign in

Signing in to the Scalus app now takes two codes

· 2 min read · Tim McCartney

Three sign in screens from the Scalus app on a phone: Client sign in with a mobile number, One more code sent to the email, and Add your mobile when only one is on file

On 22 October 2026 it was reported that some of the biggest banks in the United States, JPMorgan, Morgan Stanley, Bank of America and Wells Fargo among them, had found automated assistants acting inside customer accounts. These were pieces of software that customers had handed their logins to, and they were doing things the owners never asked for. The banks are now letting outside software look at accounts but blocking it from moving money.

Why it matters for your business

A login is only as safe as everyone and everything it has been handed to. If one code ends up in the wrong place, someone or something can change things in your account that you never asked for, and you may not find out until much later.

What I changed in the Scalus app

As part of ongoing security concerns after these recent events, I have tightened how you get into the Scalus app and what happens once you are in.

Two codes to get in. A fresh code for the big changes. An email to the owner straight away.

What you need to do

Nothing today. The next time you sign in, have your phone and your email nearby. If one of those change emails ever arrives and it was not you or your team, reply to it straight away or call me on 0420 117 774.

Questions about this one

Why does signing in to the Scalus app now take two codes?
Because of recent events. In October 2026 big US banks found automated assistants, software their customers had handed their logins to, acting inside accounts and doing things the owners never asked for. A code on your mobile and a code on your email means one stolen code is not enough to get into your Scalus app.
What if you only have my email, or only my mobile?
The sign in screen asks you to add the other one and checks it with its own code before you are let in. You only do this once.
Will I have to sign in every time?
No. Once you are in, you stay signed in on that device for 90 days. Nobody was signed out when this change went live.
Which changes need a fresh code?
Adding or removing a team member, changing your card, buying an add on (a custom email, a domain, a business name sender, Google Business Maintenance, the Store or the Google review system), and changing the number your calls ring through to or your backup mobile. Each one also sends the business owner an email straight away saying when it happened, who did it and where to change it back.