Login failures & account lockout

If a user can't log in, it's almost always one of five things. Walk through them in order.

1. Wrong password

Most common. Three signals:

• Error message is "Invalid email or password" (deliberately ambiguous so attackers can't enumerate emails).
• The user is sure their password is right but typed it wrong.
• Caps Lock is on (check first; saves embarrassment).

Fix: try once more carefully. If still failing, use Forgot Password from the login page. The email link expires in 60 minutes.

2. Account is locked

After 5 consecutive failed attempts in 15 minutes, the account is locked. Error message: "Account is locked. Please try again in 15 minutes, or use Forgot Password."

Fix:

• Wait 15 minutes — auto-unlock; no support action needed.
• Or another admin can reset the password from Settings → Users → {user} → Reset Password — this also unlocks the account.
• Or the user uses Forgot Password if they have email access.

3. MFA code rejected

User enters a fresh 6-digit code from their authenticator and gets "Invalid code".

Three causes:

• Phone clock drift — TOTP is time-based. If the phone's clock is off by more than 30 seconds, codes don't match. Turn on automatic time sync.
• Wrong code — Authy / Google Authenticator can show codes for multiple accounts; user picked the wrong one.
• Expired code — codes rotate every 30 seconds. By the time you typed it, it expired. Wait for the next one.

Fix: re-enter the most recent code. If still failing, use a backup code (from the 8 they were issued at MFA setup). Last resort: a TENANT_ADMIN resets MFA from Settings → Users → {user} → Reset MFA.

4. Email not verified

Brand-new accounts must click the verification email before first login. Error: "Email not verified. Check your inbox for a verification link."

Fix:

• Check spam folder.
• Resend from the login page → "Resend verification".
• An admin can manually verify from Settings → Users → {user} → Mark Verified.

5. Account deactivated

A TENANT_ADMIN deactivated the user. Error: "Account is inactive. Contact your administrator."

Fix: only an admin can reactivate from Settings → Users → {user} → Reactivate.

Special cases

"Tenant subdomain not found"

User went to wrongname.cargosurge.co.com. Fix: confirm the correct subdomain. The right URL is whatever was chosen at sign-up.

Driver "Can't log in" — they're on the wrong app

Drivers don't have web-app access. They use the Driver mobile app with their driver code + PIN, not email + password. See Driver app.

Customer "Can't log in" — they need the customer portal

Your customers (i.e. the people you ship for) log in at portal.cargosurge.co.com, not the main app. They need a portal user invite from Settings → Portal Users → Invite. See Customer Portal.

When to contact platform support

If none of the above resolves the issue:

• The user's email is in a domain you don't control (and Forgot Password isn't reaching them).
• The tenant has no remaining active admin.
• You suspect the account has been compromised.

Email [email protected] — include the tenant subdomain, the affected email, and what you've already tried. Don't include passwords or MFA seeds in the email.