In an effort to further increase the security of the platform, users, and reward funds, a device registration process will be required for all users (non- Nectar administrators) each time they use a new device and/or browser. This will be a one time process that occurs per user device and will increase the security of Nectar in your organization.
What is device registration?
Any time a user logs into their Nectar account from a new device, we will send them an email that looks like this:
They will then enter the 6 digit code into Nectar and their device will be registered. They will only need to do this one time per device or browser where they use Nectar.
Why is device registration necessary?
Device registration protects against users accounts being compromised when they use common passwords that are easily guessed or if they reuse a password from another site that gets compromised.
Who has to register their device?
All users who do not utilize SSO, will have to go through this device registration process at least once. Admin devices will be registered similarly through the MFA process.
Can we opt out our employees?
No. As Nectar is a system that deals with points that translate to real monetary value, this is to ensure the security of your company’s finances.
How often will users have to complete this process?
They will have to complete it once per device or browser. For example, if a user signs into Nectar on Chrome on their laptop, they will go through this process and we will register that browser on their laptop. When they login to Nectar on Chrome on the laptop again, they will not have to do the process. If they decide to login to Nectar on that same laptop but use a different browser like Microsoft Edge, they will have to go through the process again the first time they use that browser.
What is an "Expired Token"?
Expired token can either mean that your user did not enter the code received in their email before it expires, or that their overall session expired and they need to put their password in again. The user has 30 minutes to enter the code sent to their email before it expires, and a session expires every 90 days.
When a session expires after 90 days, they will have to sign in using their username and password again, but should not have to do the device registration as long as they are using the same computer or mobile phone and same browser.
Additionally, if you clear cookies or cache on your browser, you may have to complete Device Registration again.
How many attempts do users have before being locked out of their accounts? What is the time to get back in?
Users have 5 password attempts before it locks them out for 20 minutes.
Who can I contact for questions?
Please reach out to your Nectar account manager, or our Support team ([email protected]) for further questions.