Passkey and 2FA: Securing ERP for Remote Finance Teams in India

When your finance team works from home, from a client site, or from a branch office in another state, the first question an auditor asks is simple. Who exactly logged in, from where, and how do you know it was them? For most Indian small and medium businesses, the honest answer is uncomfortable. The login is a shared email and password, passed around over chat, and the system has no way to tell one accountant from another.

This is not a minor hygiene issue. With GST e-invoicing now mandatory for businesses with a turnover of ₹5 crore and above, and a strict 30-day deadline to upload invoices to the Invoice Registration Portal, the finance login has become a regulated access point. A shared password at that point is an audit finding waiting to happen. This guide explains how passkey login and two-factor authentication (2FA) close that gap, what changes the day you turn them on, and why it matters specifically for Indian businesses running a cloud ERP.

The Problem With Shared Passwords in Finance

Most finance teams did not choose shared logins out of carelessness. They chose them because the alternative was slow. A new accountant joins on Monday, the month-end close is due Friday, and nobody has time to wait for a fresh account. So the senior accountant hands over the master login. Over a year, that one login ends up on five laptops, two phones, and a sticky note on a desk.

The risks stack up quickly. You cannot tell which user posted a journal entry, because the entry says "admin" for everyone. When someone leaves the company, you change the password, but you cannot be sure every device forgot the saved credential. And when the GST officer asks for an access log that ties a specific person to a specific invoice, you have nothing real to show. The audit trail exists, but it points to a generic account, not a human.

Remote work makes this worse. A login used from an office LAN is one thing. The same login used from a home Wi-Fi network, a co-working space, or a mobile hotspot is a different exposure profile entirely. Phishing attempts target finance staff precisely because one stolen password opens the whole books. The core business system that holds your GST returns, vendor payments, and bank details deserves better than a password that four people know.

What Changes When You Turn On Passkey and 2FA

A modern ERP does not need to choose between convenience and security. It can offer both, layered, so that each user proves who they are without the team sharing a string of text. Two capabilities do the heavy lifting here, and both are built into the platform, not bolted on.

A passkey replaces the password with a credential that lives on the user's own device. The user registers their laptop, phone, or security key once, and from then on they sign in with a fingerprint, face scan, or device PIN. The server never sees the private half of the credential, so there is nothing for an attacker to steal in a breach and nothing to phish. Because each passkey belongs to a specific user and a specific device, shared logins stop working by design. The person who posted the entry is the person whose device unlocked it.

The system lets each user register multiple passkeys, label them (so you can tell "Office MacBook" from "Personal Phone"), and revoke one device without disturbing the rest. Login itself works in two modes. With an email it starts a username-first flow, and without an email it uses a discoverable-credential flow that simply lists the accounts available on that device. Either way, the handshake happens against the live session challenge, so a replayed or copied credential fails.

Two-Factor Authentication as a Second Layer

For accounts that still use a password, and as an extra gate even on passkey accounts, 2FA adds a timed code from an authenticator app. The system generates a TOTP secret, shows a QR code and a manual entry key, and issues a set of single-use backup codes. You scan the QR with any standard authenticator, enter one six-digit code to confirm the app is configured, and 2FA is live. If a user loses their phone, a backup code in the XX-XX-XX-XX format gets them back in, and each code burns after one use.

Crucially, the platform treats passkey and 2FA as a chain, not an either-or. A passkey login can still require a 2FA code to finish. That means a remote accountant can sign in with a device-bound passkey and then confirm with a rotating code, so that even a stolen laptop cannot complete a login alone. Turning 2FA off requires the account password to be re-entered, which prevents a hijacked session from silently weakening security.

What This Looks Like in the Audit Log

Every login now resolves to a named individual. Every invoice approval, every vendor payment, every GST return filed carries a real user identity behind it. When the external CA asks who released a batch of e-invoices on a given evening, the answer is a person, not a shared string. That is the shift that matters for compliance.

A Real-World Scenario

Consider a mid-sized trading company in Pune with around 140 employees and an annual turnover near ₹40 crore. Their finance team of nine handles accounts payable, GST filing, and vendor reconciliation. Roughly half the team works hybrid, logging in from home two days a week. Before the change, they used a single "finance admin" account across the team, and the senior accountant held the password.

During a GST reconciliation, they discovered that a set of input tax credit entries had been reversed twice, by two different people, on the same shared login. Reconstructing who did what took three days of email archaeology. The CFO set two rules after that incident. First, every finance user gets a personal account. Second, every account uses a passkey on their primary device, with 2FA enabled as the second step.

Within the first month, the team stopped sharing credentials entirely, because signing in with a passkey was faster than typing the old password. The CA firm confirmed that the access log now named individuals against each posted entry, which removed a standing audit objection. The estimated cost avoidance on a single potential compliance penalty was around ₹1.5 lakh, and the bigger win was reclaiming the days previously lost to "who did this" investigations.

Why This Matters for Indian Businesses

Three forces make strong login security especially urgent in India right now.

GST and the E-Invoicing Net

The e-invoicing threshold has dropped to ₹5 crore in annual aggregate turnover for many businesses, with a 30-day window to report invoices to the IRP. That pulls thousands more SMEs into a regulated process where every invoice has a chain of custody. A finance login that cannot attribute actions to a person is a structural weakness in that chain. Passkey and 2FA turn the login into an auditable identity, which is what the GST framework implicitly expects.

Remote and Hybrid Work Is Now Permanent

The finance team that came back to the office five days a week is the exception, not the rule. Hybrid arrangements mean the same user reaches the ERP from a office network, a home router, and a mobile data connection in the same week. Password-only authentication was never designed for that movement. Device-bound passkeys were. They travel safely because the credential never leaves the device, and the challenge is fresh on every login attempt.

MSME Discipline and Auditor Expectations

Indian MSMEs face growing scrutiny from banks, investors, and statutory auditors who want evidence of internal controls, not just outcomes. A clean access log that shows named users, two-factor confirmation, and revocable devices is the kind of evidence that turns a control weakness into a control strength. It also lines up with the segregation-of-duties principle that auditors already look for in purchase and payment workflows.

Is This Right for Your Business?

This approach fits if any of the following describe your team.

Your finance team logs in from more than one location, including home or branch offices.
You currently share a single login among two or more accountants.
You file GST returns and need to tie specific actions to specific people.
You have had, or want to avoid, an audit finding on access control.
You are an MSME preparing for a bank review, due diligence, or ISO-style certification.

If all of your finance work happens on a single locked-down office machine used by one person, the urgency is lower. But as soon as a second person or a remote day enters the picture, the math changes. The cost of a shared-login incident, in penalty risk and investigation time, far exceeds the cost of switching to passkey plus 2FA.

Frequently Asked Questions

Does 2FA slow down daily finance work?

Not in practice. Once a passkey is registered on a device, sign-in is a fingerprint or face scan, which is faster than typing a password. The 2FA code from an authenticator app appears on the same phone in seconds. Teams that switch typically find login gets quicker, not slower, and they stop resetting forgotten passwords entirely.

What happens if someone loses the phone with their passkey?

Each user can register more than one passkey, so a backup device keeps them working. The 2FA backup codes also provide a recovery path, since each single-use code substitutes for a missing authenticator. An admin can revoke the lost device's credential, which stops working immediately, while the user's other devices stay unaffected.

Can we still keep one shared view for the whole finance team?

You can keep shared data visibility without sharing an identity. Each accountant gets a personal login with their own passkey and 2FA, and they all see the same ledgers and invoices based on their role. What changes is that every action is attributed to a named person. Shared access to information does not require a shared login.

Key Takeaway

A shared password is the single biggest access-control weakness in most Indian finance teams, and GST e-invoicing rules have made that weakness a compliance liability. Passkey login removes the password, 2FA adds a second proof, and together they turn every finance action into something you can attribute to a person and defend in an audit. This is the floor, not a luxury.

Get Started With Kikan System

Kikan System is a modular cloud ERP built for teams that need GST-ready finance, clean audit trails, and login security that holds up under remote work. Passkey login and TOTP two-factor authentication are built in, so your finance team can sign in with a device-bound credential, confirm with a rotating code, and leave shared passwords behind. The free plan covers up to 2 users with no credit card required, which is enough to evaluate the access controls against your real month-end workflow. Visit get started to set up your workspace, or explore how Kikan System connects secure login to the rest of your core business system.