25/09/2026
A quick security update about Xero's new login screen
If you use Xero for your business, you may have noticed a change to the login process.
Xero's new login screen is rolling out and currently now automatically selects the "Trust this device" option.
The checkbox is small and easy to overlook, meaning a user may complete their MFA approval without realising that their device has been marked as trusted for up to 30 days.
Why is this important?
Xero accounts are actively targeted by cybercriminals through phishing emails, fake websites and attempts to obtain login credentials.
This is where the security risk comes in. If a hacker gains access to a device that has been trusted for Xero, they may be able to access the Xero account without being challenged by MFA during the trusted period.
This is particularly relevant to businesses where Xero is accessed by multiple people or from shared devices.
What can you do?
The next time you log into Xero, take a moment to un-check the "Trust this device" option before completing MFA.
Only trust devices that are secure and under your control.
If you have accidentally trusted a device, we recommend clearing the Xero cache. We have found that simply clearing cookies may not remove the trusted-device setting.
How to clear your browser cache
Google Chrome
Open Chrome.
Click the three dots (...) in the top-right corner.
Select Settings.
Select Privacy and security.
Select Delete browsing data.
Select Cached images and files.
Choose the appropriate time range.
Click Delete data.
Close and reopen Xero and log in again.
Microsoft Edge
Open Edge.
Click the three dots (...) in the top-right corner.
Select Settings.
Select Privacy, search and services.
Under Clear browsing data, select Choose what to clear.
Select Cached images and files.
Choose the appropriate time range.
Click Clear now.
Close and reopen Xero and log in again.
Mozilla Firefox
Open Firefox.
Click the three lines ☰ in the top-right corner.
Select Settings.
Select Privacy & Security.
Under Cookies & Site Data, select Clear Data.
Select Temporary cached files and pages.
Click Clear.
Close and reopen Xero and log in again.
Safari (Mac)
Open Safari.
Select Safari → Settings.
Select Advanced.
Turn on Show features for web developers, if required.
From the menu bar, select Develop.
Select Empty Caches.
Close and reopen Xero and log in again.
If other people have access to your Xero organisation, please share this information with them.
This could include employees, administrators, payroll staff, accountants, bookkeepers and other authorised users.
