Setting Up Two-Factor Authentication on ova
To enable 2FA on your ova account, navigate to your account settings and select "Security" or "Two-Factor Authentication." We support two primary 2FA methods:
- SMS-based 2FA: You provide your registered mobile number. When you attempt a sensitive action (withdrawal, password change, login from a new device), we send a one-time code via SMS. You enter this code within a specified time window (typically subject to verification) to complete the action.
- Authenticator app 2FA: You download an authenticator application (such as Google Authenticator, Microsoft Authenticator, or Authy) and scan a QR code generated by ova. The app generates time-based codes that refresh every 30 seconds. When you need to verify an action, you enter the current code from the app instead of receiving an SMS.
If you choose SMS-based 2FA, confirm your phone number on the ova platform. We send a test code to verify the number is active and working. Once confirmed, 2FA is live on your account. From that point forward, every withdrawal request, password reset, or login from an unrecognized device will require an SMS code.
If you prefer authenticator-app 2FA, ova generates a QR code during setup. Scan this code with your authenticator app; the app will add ova to your list of protected accounts and begin generating codes automatically. Save the backup codes that ova provides during setup — these codes allow you to regain access to your account if you lose your phone or the authenticator app.
2FA during the withdrawal process
When you request a withdrawal from your ova account balance and 2FA is enabled, the flow changes slightly. After you select your withdrawal destination (e.g., a BCA virtual account, e-wallet e-wallet, or mobile banking), confirm the amount, and submit the withdrawal request, ova does not immediately process it. Instead, we send a verification code to your registered phone or authenticator app.
You have a limited time window (typically subject to verification for SMS codes, indefinite for authenticator-app codes until the 30-second window expires) to enter this code on the ova withdrawal confirmation screen. Once you enter the correct code, the withdrawal is authenticated and submitted for processing. Your account balance is deducted, and funds are routed to your chosen destination according to the settlement timeline for that method (e-wallets typically within minutes; bank transfers within one to two business days).
2FA verification triggers on ova
- Withdrawal requests (any amount, any destination)
- Password changes or password resets
- Adding or modifying a linked bank account or e-wallet
- Disabling or modifying 2FA settings
- Login from a device or location not previously recognized
Password reset and 2FA recovery
If you forget your ova password and 2FA is enabled, the password-reset flow includes a 2FA verification step. You request a password reset via your registered email address. We send a reset link to your email. When you click the link and set a new password, we require you to enter a 2FA code to confirm the reset is legitimate. This prevents attackers from resetting your password and accessing your account even if they compromise your email.
If you lose access to your phone or authenticator app and cannot generate 2FA codes, you can use the backup codes we provided during 2FA setup. Each backup code is single-use and can be used in place of a live 2FA code. If you have exhausted your backup codes, contact ova support with proof of identity (your national ID number and registered email address). Our support team will help you regain access after verifying your identity.
2FA and account security best practices
Enabling 2FA on ova significantly reduces the risk of unauthorized account access. Combined with a strong, unique password, 2FA makes it extremely difficult for attackers to compromise your account even if they obtain your password through phishing or data breaches.
- SMS vs. Authenticator App
- SMS-based 2FA is convenient but vulnerable to SIM-swap attacks (attackers redirect your SMS to a different phone). Authenticator-app 2FA is more secure because codes are generated locally and not transmitted over networks.
- Backup codes
- Store your backup codes in a secure location separate from your phone (e.g., a password manager or a printed copy in a safe). Do not share these codes with anyone.
- Device security
- Keep your phone or computer updated with the latest security patches. Avoid installing untrusted apps or clicking suspicious links, especially on devices where you receive or generate 2FA codes.
2FA across ova's game and betting categories
Once 2FA is enabled on your ova account, it protects all activities on the platform — Liga 1 football bets, live-dealer table sessions (blackjack, roulette, baccarat, Dragon Tiger), slot games (Aviator, Sweet Bonanza, Gates of Olympus, Fortune Tiger, Mahjong Ways), and esports markets (Mobile Legends, Free Fire, PUBG Mobile). You do not need to set up separate 2FA for each category; a single 2FA configuration covers your entire ova account.
Your account balance is unified across all categories. If you accumulate winnings from a Liga 1 bet and decide to withdraw, the 2FA verification protects that withdrawal regardless of which game category the winnings originated from. Similarly, if you switch from a roulette session in Jakarta to an esports bet in Surabaya, your 2FA settings remain unchanged and continue to protect sensitive actions like balance transfers or withdrawals.
Advantages of 2FA
- Protects against unauthorized withdrawals and password resets
- Works across all ova game and betting categories
- Quick to set up; can be disabled anytime from account settings
- Backup codes ensure account recovery if you lose your phone
Considerations
- SMS codes expire after subject to verification; must be entered promptly
- Lost phone or authenticator app requires backup codes or support contact
- Authenticator apps are not synced across devices; installing on a new phone requires reconfiguration
2FA during major events and holiday seasons
During high-activity periods (Liga 1 season finales, Piala Indonesia finals, Idul Fitri or Idul Adha holidays, Imlek celebrations, or Nyepi observances), withdrawal volumes on ova increase significantly. Your 2FA verification remains the same regardless of the season, but we recommend keeping your phone charged and accessible during major betting events. If you are traveling between cities (Jakarta, Surabaya, Bandung, Medan, Semarang, Yogyakarta), ensure your 2FA method (SMS or authenticator app) is functional in your current location.
If you plan to be in a region with poor cellular coverage, consider switching from SMS-based 2FA to authenticator-app 2FA before you travel. Authenticator apps do not require network connectivity to generate codes, so they work reliably even in areas with limited cell signal or internet access.