Enabling two-factor authentication (2FA)

Why 2FA is essential for betting

2FA (two-factor authentication) adds a second barrier to your account, on top of the password.

Without 2FA: to steal your account, an attacker must guess your password.

With 2FA: to steal your account, an attacker must guess your password AND have physical access to your 2FA device (phone, hardware key). Without both, impossible.

Why it's particularly important on Ktkarena:

• You have real money on the platform.
• The completed KYC makes your account attractive to fraudsters (if they get it, they can withdraw to their account with a KYC already done in your name).
• Phishing techniques are exploding in French-speaking Africa.

Our strong recommendation: enable 2FA as soon as you deposit more than 50,000 KTK on the platform. Beyond that, it's risky not to have this protection.

The 2 available 2FA methods

Method 1 - Authenticator app (recommended for most people).

You install an app on your phone (Google Authenticator, Microsoft Authenticator, Authy, 1Password, etc.). This app generates a 6-digit code that changes every 30 seconds. At every login, you enter this code in addition to your password.

Advantages:

• Free.
• Works even without an internet connection (the code is computed locally).
• Very secure.

Drawbacks:

• If you lose/break your phone, you lose access to your 2FA (but we have a procedure for that - see I lost my phone with my 2FA).

Method 2 - Hardware key (for very high security).

You buy a USB security key (YubiKey, Google Titan). At every login, you insert or tap the key.

Advantages:

• The strongest security in the world.
• Impossible to phish (the key verifies you're logging in to the real Ktkarena).

Drawbacks:

• Cost: €30-60 per key.
• You must always have it with you.
• More complicated to set up.

For 95% of bettors, the authenticator app is more than enough. You can always upgrade to a hardware key later.

Enabling the authenticator app: step by step

1. Install an authenticator app on your phone. Our recommendations:
   • Google Authenticator (free, simple).
   • Authy (free, with cloud backup - useful if you change phones).
   • 1Password (paid, but combines 2FA + password manager).
2. In the Ktkarena app, go to Profile → Security → Two-factor authentication.
3. Choose "Authenticator app" as your method.
4. The app displays a QR code. Open Google Authenticator (or another app) and tap "+" to add an account → "Scan a QR code". Scan the QR.
5. The app immediately generates a 6-digit code for Ktkarena. Enter this code in the Ktkarena app to confirm.
6. Ktkarena shows you your recovery codes (10 single-use codes). Write them down or copy them immediately. See next section.
7. Confirm activation. Done. Starting with your next login, you'll need to enter your password + the code from the app.

Recovery codes: never lose them

When you enable 2FA, Ktkarena gives you 10 recovery codes. These are single-use codes you can use if you no longer have access to your authenticator app.

Example: A7B2-9F4D-X3K1, M5N8-Q2R4-T7Y9, etc.

Critically important: these codes are your safety net. Without them, if you lose your phone, you can end up completely locked out of your account. The recovery procedure without codes is long (in-depth identity verification, 48-72h minimum).

Where to keep them:

Good practices:

• ✅ Print them and keep the sheet somewhere safe (safe, locked binder).
• ✅ Save them in your password manager (Bitwarden, 1Password).
• ✅ Photograph them and store the photo in an encrypted cloud (iCloud, Google Drive with 2FA).

Bad practices:

• ❌ Leaving them on a Post-it on your screen.
• ❌ Screenshotting them and leaving them in your phone's photo gallery (which is in your pocket every day).
• ❌ Sending them to yourself via WhatsApp (not encrypted).
• ❌ Forgetting about them entirely (the most frequent case).

Each code can only be used once. When you've used 5 codes out of 10, you can regenerate a new set of 10 codes from Profile → Security → 2FA → Regenerate codes.