HMRC multi-factor authentication (MFA) adds a one-time access code as an extra step after you enter your Government Gateway user ID and password when signing in to HMRC online services. It already applies to individual and organisation accounts, and the remaining tax agent accounts are switched on automatically between 28 September and 15 October 2026.
In plain terms: nothing about your tax changes. No rate, no deadline and no Making Tax Digital obligation moves. This is purely a login security change. But if you or your accountant are caught unprepared during the agent rollout window, you could temporarily lose access to your account, so it pays to set your method up now. Here is exactly how it works.
What is HMRC multi-factor authentication?
Multi-factor authentication (sometimes called two-factor authentication or 2FA) means proving who you are with two separate things: something you know (your Government Gateway user ID and password) and something you have (a phone or an app that receives a one-time access code). After you type your password, HMRC asks for a short security code before it lets you in.
The access code is single-use and time-limited. Someone who has stolen or guessed your password still cannot get into your account, because they do not have your phone. That is the whole point: the code is the second lock on the door.
Why is HMRC introducing MFA?
HMRC says MFA protects your account even if your sign-in details are compromised, and that it is extending the measure in response to evolving online security threats. Tax accounts hold sensitive personal and financial data and, in the wrong hands, can be used to file fraudulent claims or repayments. A password on its own is no longer considered enough.
This is not a Zmartly or agent-specific rule. It is HMRC hardening the front door for everyone who uses its online services, in line with wider government security standards.
What is changing, and when?
MFA is already in place and mandatory for individual and organisation Government Gateway accounts. If you sign in to your own Self Assessment, VAT or PAYE account, you may well be using it already.
The change in 2026 targets the remaining tax agent accounts: the Agent Services Account (ASA) and the legacy HMRC online services for agents account (sometimes called the Online Services Account, or OSA). HMRC is automatically activating MFA on these accounts between 28 September 2026 and 15 October 2026.
Crucially, HMRC cannot give a specific activation date for each individual account inside that window. Your firm's account could switch on at any point across those roughly two and a half weeks. Because of that uncertainty, HMRC advises setting up your MFA method in advance so you do not lose access when the switch flips.
A worked example: an agent account activated mid-window
Ravi runs a small practice and files for around 40 Self Assessment clients through his Agent Services Account. He does not know his exact activation date, only that it falls between 28 September and 15 October 2026. On 24 September, before the window opens, he sets up an authenticator app as his access-code method and adds a mobile number as a backup.
His account is automatically activated on 6 October. Because he prepared 12 days earlier, that morning he simply signs in, opens his authenticator app, reads off the six-digit code and carries on filing. A colleague who left it until activation day found the account asking for a code before any method was configured, and lost an afternoon to HMRC's recovery route. The lesson: set up before the window, not during it.
How does the access code reach you?
HMRC lets you receive the one-time access code in one of three ways. You can pick the one that suits how you work, and where possible you should set up more than one so you have a fallback.
| Method | How the code reaches you | Works without phone signal? | Best for |
|---|---|---|---|
| Text message | A text (SMS) is sent to your mobile phone each time you sign in | No, needs mobile signal | People who always have their mobile to hand and good coverage |
| Voice call | An automated voice call reads the code to a mobile or a landline | Landline works without mobile signal; mobile call needs signal | Anyone without a smartphone, or who prefers a landline |
| Authenticator app | An app on a smartphone, tablet or desktop computer generates the code | Yes, works even with no phone signal | Frequent sign-ins, poor signal, or the most reliable option |
The authenticator app is generally the most robust choice because it generates the code on the device itself. It does not depend on a text arriving or a call connecting, and it works on a smartphone, tablet or desktop computer even when you have no phone signal at all.
How do I set up MFA and choose a method?
Setting up MFA is done inside HMRC online services when you sign in. The broad steps are the same whichever method you choose:
- Sign in to HMRC online services with your Government Gateway user ID and password.
- When prompted, choose how you want to receive your access code: text message, voice call, or an authenticator app.
- For text or voice, enter the mobile number or landline you want HMRC to use.
- For an authenticator app, install one on your smartphone, tablet or computer, then scan the on-screen code (or enter the setup key) to link it to your account.
- Confirm by entering the first access code HMRC sends or the app generates.
- Where the option is offered, add a second method as a backup so you are never locked out if you lose access to the first.
Do this before the agent activation window if you are a tax agent, and now if you are an individual or organisation account holder who has not yet set it up. If you manage your VAT online, our guide to the HMRC VAT login and account access walks through the same sign-in journey.
What if my accountant files for me?
If you are a small business owner, sole trader or landlord whose accountant files on your behalf, the agent MFA rollout affects your accountant's login, not your own account. You do not need to do anything to their agent account. However:
- If you also sign in to your own individual or organisation account, MFA already applies to you, so make sure your own method is set up and working.
- Ask your accountant to confirm they have prepared their MFA method ahead of the 28 September to 15 October 2026 window, so your filings are not delayed if their account is switched on unexpectedly.
- Keep your Government Gateway details and your Unique Taxpayer Reference (UTR) to hand, as you may need them to prove identity if any access issue arises.
None of this changes who is authorised to act for you. If you are weighing up whether to hand filing to a professional at all, our overview of whether your accountant can file MTD for you is a useful starting point, and our Self Assessment services handle the sign-in, security and filing for you.
What if I lose access to my phone or the code does not arrive?
If you lose your phone, change your number, or the access code simply does not come through, you follow HMRC's "problems signing in" recovery route to regain access. This is why setting up more than one method matters: if the text does not arrive, a voice call or authenticator app can get you in without a recovery process.
Practical steps to avoid a lockout:
- Add a second access-code method wherever HMRC lets you, so one failure is not a lockout.
- Keep the mobile number and landline on your account current, and update them promptly if they change.
- If you use an authenticator app, note the setup key or back it up, so a new phone can be linked quickly.
- If you are genuinely locked out, use HMRC's problems-signing-in guidance rather than creating a brand new Government Gateway account, which can split your tax records.
How does MFA fit the wider push to secure HMRC accounts?
MFA is one strand of HMRC steadily tightening access to online services. Individual and organisation accounts came first; agent accounts complete the picture in the autumn 2026 window. It sits alongside the broader digital shift, including Making Tax Digital sign-up, where more taxpayers are moving to online filing and therefore more accounts need protecting.
To be clear once more: MFA does not change any tax rate, filing deadline or MTD obligation. Your Self Assessment deadline is unchanged. What changes is only how you prove it is really you at the door.
Frequently asked questions
Do I have to set up MFA, or is it optional?
It is mandatory. MFA already applies to individual and organisation Government Gateway accounts, and it is being automatically activated on the remaining tax agent accounts between 28 September and 15 October 2026. You cannot opt out, but you can choose which access-code method you use.
Which access-code method is best if I have poor phone signal?
An authenticator app. It generates the code on your smartphone, tablet or desktop computer and works even without phone signal, so it does not depend on a text arriving or a call connecting. A voice call to a landline is another option that does not need mobile coverage.
Does MFA change my tax or filing deadlines?
No. MFA is a security change to how you sign in to HMRC online services. It does not change any tax rate, penalty, filing deadline or Making Tax Digital obligation. Everything about what you file and when stays the same.
What happens if I lose my phone during the agent rollout?
You follow HMRC's 'problems signing in' recovery route to regain access. To avoid downtime, set up more than one access-code method in advance and keep your contact numbers up to date, so losing one device does not lock you out.
Not sure your HMRC access is ready for the change? Book a free call with Zmartly and we will make sure your Self Assessment sign-in and filing are secure and switch-over proof.
