The code is typed in, the spinner keeps going, and Altru never loads. Or a new hire is told to “open your authenticator app” and has no idea which app or why. Multi-factor sign-in trips up most Altru shops at least once. Usually the cause is something mundane on the device or in the browser, not a problem with the account.
This guide covers the problems we see most often, roughly from most to least common, and what to try for each. One thing to know up front: Altru sign-in runs through Blackbaud ID, Blackbaud’s shared login service, so most MFA behavior is controlled there and not inside Altru. That matters when you need to reset something or contact support.
Why you’re being asked for an authenticator app at all
Blackbaud has steadily tightened sign-in security across its products, and two-step verification on Blackbaud ID is part of that. For Altru users that usually means entering a six-digit code from an authenticator app (Microsoft Authenticator, Google Authenticator, Authy, or similar) after your password.
Whether text message or email codes are allowed for your account, and whether your organization can opt out, depends on Blackbaud’s current policy and your organization’s settings. Those have changed over time. If staff are asking “do we really have to use an app?”, check Blackbaud’s current Blackbaud ID documentation or ask Blackbaud support rather than relying on what was true a year ago.
The code is rejected or “invalid”
Authenticator codes are generated from the current time. If the phone’s clock is off by even a minute or so, every code it generates will be wrong.
- Turn on automatic date and time on the phone. This fixes more “invalid code” complaints than anything else, especially on phones where someone set the time by hand.
- Check the account in the app. People who use several Blackbaud products, or who set up MFA twice, can end up with more than one Blackbaud entry in the app. Only the newest one works. Delete the old ones once you’ve confirmed which code is accepted.
- Wait for a fresh code. Entering a code in its last few seconds often fails. Let it roll over and type the new one.
The screen freezes after you enter the code
When sign-in hangs, loops back to the login page, or sits on a blank screen, the browser is usually the culprit.
- Close every Altru and Blackbaud tab, then sign in from a single new tab. Half-finished sessions in other tabs can collide with the new one.
- Try a private or incognito window. If it works there, the problem is stored cookies or a browser extension.
- Clear cookies and cached data for Blackbaud sites in your normal browser, then sign in again.
- Disable extensions temporarily. Ad blockers, privacy tools, and password managers that auto-submit forms are common offenders.
- Try another supported browser. If one browser consistently fails and another works, you’ve narrowed it to that browser’s settings or profile.
- Rule out the network. A VPN, a strict firewall, or a content filter on guest or kiosk Wi-Fi can block part of the sign-in flow. Test the same computer on a different connection, such as a phone hotspot, before you call IT.
If none of those help and several people are affected at once, check Blackbaud’s status page. Sign-in outages do happen, and no amount of cache-clearing will fix them.
Someone lost or replaced their phone
This is the one you can’t fix from the desk. Authenticator apps don’t always move codes to a new phone, and a wiped or lost phone takes the codes with it.
- If the person saved recovery or backup codes when they set up two-step verification, they can use one to get in and then re-enroll the new phone.
- If not, the two-step setting has to be reset. Depending on how your organization is set up, an admin may be able to help, but often this goes through Blackbaud support, who will verify the person’s identity. Plan for it to take some time.
- Before anyone trades in a phone, have them sign in and set up the authenticator on the new device first. Put that step in your staff offboarding and device checklists.
Shared front-desk logins stop working
MFA assumes one login belongs to one person with one phone. A generic “frontdesk” account that five cashiers share doesn’t fit. The codes live on one person’s device, and when that person is off, nobody else can sign in.
The real fix is to give each staff member, including seasonal and part-time staff, their own Altru user tied to their own Blackbaud ID. That’s also better practice for audit trails, since you can see who processed which transaction. If phones aren’t allowed on the floor, talk to IT about a desktop authenticator option or a policy that lets staff use their phones just for sign-in. Do not get around this by putting one account’s authenticator secret on several phones. It undoes the point of MFA and tends to break the next time anyone re-enrolls.
Reduce how often people sign in
Much of the MFA frustration at a ticket counter comes from signing in over and over. A few habits help:
- Have staff use their own browser profile on a shared workstation, so their session isn’t wiped by the next person.
- Avoid tools that clear cookies on browser close on registers, unless your security policy requires it.
- Get everyone signed in before doors open, not when the first guest is already at the window.
When to call Blackbaud support
Contact support when a user needs two-step verification reset, when the error message mentions the account being locked or disabled, or when sign-in fails for everyone across several browsers and networks. Have the user’s email address, the exact error text, and the browser and device ready. A screenshot of the error saves a round of back-and-forth.
Quick answers
Can we turn MFA off for Altru?
Probably not, and you shouldn’t plan around it. Blackbaud sets the sign-in requirements. Ask support what options your organization has, if any.
Which authenticator app should staff use?
Any standard time-based authenticator app should work. Pick one for the whole team so training and troubleshooting are consistent.
Codes worked yesterday and fail today. What changed?
Check the phone’s clock first, then whether the person re-enrolled and is reading an old entry in the app.
