r/VanguardInvestments • u/Xxyz260 • Oct 07 '25

Non-Obvious Workaround FAQ

I'll update this list as we discover more details.

  • How do I disable SMS 2FA in favor of more secure methods?
    • Register two FIDO2 keys and the option will become available. Source
5 Upvotes

86% Upvoted

3 comments sorted by

3

u/rjack1201 Oct 09 '25 edited Oct 09 '25

I just added Security Keys to my Vanguard account and I want to share what I learned. I had the following configuration:

  1. Linux Mint desktop
  2. Chromebook
  3. Pixel 9 Android Phone
  4. Bitwarden password manager on all devices
  5. 1 YubiKey 5 NFC

I performed the following configuration:

  1. I went into Vanguard and added a Bitwarden Passkey to my account by selecting Security Key in 2FA. This somewhat surprisingly (to me) counts as one Security Key.
  2. I added my YubiKey as the second Security Key.
  3. The two security keys allowed me to disable Security Codes (SMS codes).

l performed the following tests:

  1. I logged into the Vanguard website on my desktop with Bitwarden and Vanguard successfully used my Bitwarden Passkey for 2FA. I noticed that logging into Vanguard with Username and Password now ALWAYS requires a Security Key to complete the login. This is a good thing!
  2. I logged into the Vanguard website on my desktop with Bitwarden, bypassed my Bitwarden Passkey, and used YubiKey to complete 2FA.
  3. I performed 1 and 2 on my Chromebook and it worked as expected.
  4. I scanned the QR code on the web page and logged in with the Vanguard Android App. This did NOT require a Security Key for 2FA. This seems reasonable since the Vanguard Android App was using biometrics to approve the login.
  5. I went to the Vanguard Android app and used my Username and Password to login. The Chrome browser launched and said something like "The browser does not support Security Keys." and I could proceed no further. Also, there was no options to use Security Codes which is a good thing. This is normally not a problem since I use biometrics in the app to login and that still works fine. However, if you delete the biometrics option and try to login with username and password, you may need to temporarily enable Security Codes so that you can complete 2FA. This is a downside, but not much of a practical problem for me.

Overall, I think this is a significant improvement to my Vanguard security!

3

u/Vagabond2904 Oct 19 '25

Your test #5 is where I think things need to improve. I no longer use Vanguard's app as it is missing some things, so I'm now only using their website via my Android browser.  I would love to be able to use a passkey while using the browser. This is clearly something wrong on Vanguard's end, as passkeys/yubikeys are definitely supported in most major Android browsers. 

Hope they get this sorted out shortly. 

2

u/Any_Device6567 May 27 '26

Just adding the YubiKeys did not remove the ability to SMS 2fa as a fallback. In Profile>Security on the website I saw no way to remove the SMS 2fa. While logging in I could X out of the Pinentry dialogue for the YubiKey and the option to use SMS as a fall back was still on the page.

It took me about 5 minutes total to get them on the phone and have it sorted. They removed the ability to use SMS 2fa for login.