HMRC sign-in problems and how to fix them

Before you try anything, read the error properly. HMRC's sign-in journey produces several messages that look similar and mean very different things, and trying the wrong fix wastes attempts you cannot afford — because failed attempts are what trigger the lockout in the first place.

The first problem is not knowing the Government Gateway user ID: the long string of digits issued when you first registered, which almost nobody memorises and most people wrote down once. The second is knowing the user ID but not the password. These are separate recovery journeys on GOV.UK, and the page tells you which one you need when you try to sign in — as GOV.UK puts it, "You'll be told how to do this when you try to sign in."

The third is the lockout. GOV.UK is explicit: "You'll be locked out of your account if you enter the wrong sign in details too many times." The lock lasts two hours and lifts itself, and — this is the part people spend an afternoon on the phone discovering — helpdesk advisers cannot unlock it for you. There is nothing to do but stop.

The fourth is the access code. HMRC sends a code by text message, by voice call, or through an authenticator app, and the code failing is not the same as the password failing. A code that does not arrive on a phone you still hold is usually a delivery problem. A code sent to a number you no longer control is an account-details problem, and it is fixed from a different screen entirely.

The fifth is not a sign-in problem at all. If HMRC tells you it cannot confirm your identity, the credentials worked and the barrier is the identity check behind them. HMRC's own service design guidance describes this happening when someone "provides details that do not match those we have on file", does not complete the process, gives too little information, or "makes too many attempts" — and in that last case the guidance is to wait 24 hours before trying again.

Finally, rule out the mundane. HMRC publishes service availability and known issues for its individual online services, and a separate page for known Government Gateway problems, which at the time of writing reports no planned downtime and no service issues. Check those before assuming the fault is yours, particularly in the last week of January when the systems are under load and GOV.UK itself warns that services "may be slow during busy times".

Start at the HMRC sign-in page on GOV.UK, not at a link in an email. Type the address, or reach it from the service you are trying to use. HMRC does not send sign-in links, and the sign-in page is one of the most heavily impersonated pages in the country.

Choose the option to recover your sign-in details rather than to reset a password. GOV.UK's guidance is short on this point — "You can recover or reset your sign in details if you've lost them" — because the journey itself does the explaining once you are in it.

The recovery route works from the email address registered against the user ID. This is the crux of the whole exercise. HMRC's account recovery service states plainly that "You need to have an email address associated with your Government Gateway user ID", and that without one "For security reasons you need to call an HMRC helpline." There is no online workaround, and no adviser can create one for you mid-call.

So before you start, work out which email address you would have used. For most people that is the address they had when they first registered — often years ago, often a work address at a job they have left, sometimes an internet provider's address that died with the contract. If you can still receive mail at that address, the recovery is a two-minute job. If you cannot, skip ahead to the section on phoning HMRC, because that is now your only route.

Search your email archive before you do anything else. The user ID is issued at registration and confirmed by email at the time, so the original message is often still there. Searching for "Government Gateway" across all folders, including deleted and archived mail, resolves a surprising proportion of these cases without any recovery process at all. The same applies to old paperwork: the user ID was frequently printed out and filed with the year's tax papers.

Once you have the user ID, store it somewhere you will still be able to reach in five years — a password manager, not a note on the phone you are about to replace. Check too, while you are signed in, that the email address and mobile number held on the account are ones you still control. Almost every hard case on this page begins with details that were correct when they were entered and are not now.

One further trap: you may have more than one Government Gateway user ID. It is common for someone to hold one as an individual, one for a limited company, and one created years earlier for a service they have forgotten. They are separate accounts with separate credentials, and recovering one does not surface the others. If the user ID you recover does not show the service you expected, the likeliest explanation is that the service sits on a different account.

A password reset is the simpler journey of the two, because you already hold the identifier. From the HMRC sign-in page, enter the user ID, then choose the option to reset the password when the sign-in fails or before you attempt it. The reset is confirmed through the details held on the account, which in practice means the registered email address, the registered phone, or both.

Do not guess. This is the single most expensive habit in the whole process. Each wrong attempt takes you closer to the lock, and GOV.UK is unambiguous about what happens next: the account locks, the lock lasts two hours, and "Helpdesk advisers cannot unlock your account." That is not an adviser being unhelpful or a supervisor being able to override it. The unlock is automatic and time-based, and no human at HMRC has a button for it.

If you are already locked out, the correct response is to do nothing for two hours. Ringing the online services helpdesk during that window achieves nothing except a place in a January queue. Use the time productively instead: find the registered email address, dig out your National Insurance number and Unique Taxpayer Reference, and have a recent payslip, P60 or tax return to hand, because whichever route you take next will want them.

When you do get back in, change the password to something you have not used elsewhere and record it properly. The National Cyber Security Centre's three-random-words approach produces passwords people can actually recall, and a password manager removes the problem entirely. A tax account is a high-value target: it holds your income history, your bank details for repayments, and enough personal data to open credit in your name.

Beware of the two-account confusion at this stage. If HMRC has moved you, or you created your account after February 2026, your sign-in may be a GOV.UK One Login — an email address and password — rather than a Government Gateway user ID and password. The reset journeys are different services entirely, and trying to reset a One Login password on the Government Gateway journey simply fails. GOV.UK's own sign-in page now offers both options, so read which one you are on.

Finally, if the password reset works but the sign-in still fails, you have moved on to the next problem rather than solved this one — almost certainly the access code. That is dealt with next.

HMRC applies two-step verification to online services, so after the user ID and password there is a code to enter. GOV.UK confirms the three delivery methods: "You can get an access code by text message, voice call or authenticator app." Which of those your account uses was decided when the account was set up, and most people chose text message without thinking about it.

If the code has simply not arrived on a phone you still hold, work through the mundane causes first. Check the signal, check that the number on the account is the one in your hand, and wait a few minutes before requesting another — requesting several in quick succession produces several codes, and only the most recent one works, which is a common way of locking yourself out while holding a valid code. If you are abroad, a UK mobile roaming can be slow to receive service messages, and the voice call option is often more reliable.

The important route is the one nobody writes down. If the number on the account is dead — a lost phone, a changed number, a work SIM you handed back — you do not need to abandon the account. GOV.UK states that "You can change how you receive your access code, for example, if you change your phone number", and the mechanism is to sign in with your user ID and password as normal, then select the 'You can get help' option on the screen that asks for the code. That link is the door, and it is easy to miss because it looks like a help article rather than a recovery route.

Follow the steps from there and expect to be asked to confirm your identity. GOV.UK says so directly — "You may need to confirm your identity" — and this is deliberate. Changing the second factor on an account is precisely what an attacker who has stolen a password wants to do, so the check that stands in your way is the same check that stands in theirs. If it were easy, the two-step verification would not be doing anything.

If you still have the account and the phone, switch to an authenticator app before you next change your number. An authenticator app generates codes on the device itself rather than depending on a particular SIM receiving a message, which removes the entire class of problem this section describes. It also survives a change of network and works with no signal at all. The trade-off is that losing the device without a backup is worse, so record the recovery codes the app offers.

Where an access code arrives without you asking for one, treat that as a security incident rather than a glitch. HMRC lists it explicitly as a sign of unauthorised access — "account access codes being sent to your phone when you have not tried to sign in" — alongside a password that has been changed without you. Report it through HMRC's suspicious activity route rather than continuing to try to sign in.

Plenty of people get past the password and the code and then hit a wall: HMRC asks them to prove who they are, and the check fails. This is a different barrier with different rules, and it is worth understanding because the instinct — try again immediately, then try again — is exactly wrong.

GOV.UK's personal tax account page sets the expectation: "You'll be told when you sign in if you need to prove your identity. This is to keep your details safe and normally involves using photo ID like a passport or driving licence." The check is not run on every sign-in. It appears when you first access a service that exposes personal records, when you are changing something sensitive such as the phone number that receives your access codes, or when HMRC's own risk rules flag the attempt.

HMRC's published service design pattern describes the failure states candidly. Confirmation fails where the user "provides details that do not match those we have on file", where they do not complete the process, where they do not provide enough information, or where they "make too many attempts" — and in that last case the instruction is to "wait 24 hours and then sign in to try again". Twenty-four hours is a long time in the last week of January, which is a reason to do this early rather than on deadline day.

Where the identity check runs through GOV.UK One Login rather than the older HMRC journey, the mechanics are published in more detail. GOV.UK sets out three routes: the GOV.UK One Login app with a photo ID and a face scan; answering security questions online; or an in-person check at a participating Post Office. The app accepts a UK photocard driving licence, a UK passport, a non-UK passport with a biometric chip, a UK biometric residence permit or card, or a UK Frontier Worker permit. Expired passports are not accepted, though a driving licence expired within 90 days may be.

The security-questions route is the one that catches people out, and it is unforgiving. GOV.UK explains that answers about "your mobile phone contract, mortgages, loans or bank accounts" are checked against records held by Experian, and questions about Personal Independence Payment are checked against DWP records. You need either photo ID or a current UK bank or building society account to use it at all, and the name on your document must match the records held "including any middle names or initials". Crucially: "If you've made a mistake in your answers you cannot try this method again." One attempt, then a different route.

That last point deserves emphasis, because it means a thin credit file is a genuine blocker rather than an inconvenience. If you have recently arrived in the UK, have no credit agreements, have moved house often, or have a name recorded differently across your documents, the automated route may never work. That is not a failure on your part and it is not something a helpline can override — but it is the point at which the phone becomes the answer rather than the last resort. Our guide to proving your identity without photo ID covers the wider fallback map.

If your identity check fails, consider whether you can do what you came to do without it. HMRC's design guidance instructs services to "offer the user a way of continuing to use the service where possible", and gives the example of changing other VAT details without confirming your identity. Some tasks genuinely do not need the check, and a filing deadline is a good reason to find out which.

There is a point at which the online routes are exhausted — most obviously when there is no email address on the Government Gateway account, which HMRC's own recovery service says means "you need to call an HMRC helpline". Choosing the right one matters, because HMRC's helplines are strictly siloed and being transferred is not guaranteed.

For anything that is genuinely a sign-in or technical problem, the line is the HMRC online services helpdesk on 0300 200 3600, or +44 161 930 8445 from outside the UK, open Monday to Friday 8am to 6pm and closed on bank holidays. Relay UK users dial 18001 then the number. GOV.UK says this line covers error messages in online services, problems verifying your identity, and issues with login details and access codes. It explicitly does not cover tax queries, and it does not cover VAT online services, which have their own helpdesk on 0300 200 3701.

If the underlying task is a Self Assessment one — a return you cannot file, a payment you cannot make, a notice you have received — the Self Assessment helpline on 0300 200 3310 (+44 161 931 9070 from abroad) may be the better call, on the same weekday hours. For PAYE and tax code problems the Income Tax general enquiries line is 0300 200 3300, or +44 135 535 9022 from outside the UK. The distinction is not pedantic: the online services helpdesk cannot discuss your tax position, and the tax lines cannot fix your credentials.

Before you call, get your details in order. GOV.UK's own advice for these lines is to make sure your personal details and address are up to date in your personal or business tax account, because you will be asked security questions. Have your National Insurance number, your Unique Taxpayer Reference if you have one, and recent HMRC correspondence in front of you. If you are calling about a business account, have the VAT registration number or PAYE reference and the postcode HMRC holds.

Set your expectations about what the adviser can do. They can talk you through a recovery route, resend details to an address HMRC already holds, and correct records where they have gone wrong. They cannot lift a two-hour lockout, they cannot read your password back to you, and they cannot short-circuit an identity check by vouching for you over the phone. Where HMRC does hold something you need but cannot send digitally, the fallback is usually post — which is slow and needs building into your timetable.

If speaking on the phone is difficult, HMRC's extra support team exists precisely for this. GOV.UK says you can get a phone or video appointment with it, and that you can ask for it when you call an ordinary helpline or use the extra support webchat. It covers people with cognitive or developmental conditions, physical disabilities, sensory impairments, mental health conditions, those in financial hardship or experiencing domestic abuse, and those receiving hospital treatment. It is a properly resourced route, not a token one, and it is under-used.

There is also a digital assistant on GOV.UK's HMRC pages which can hand you to a webchat adviser where one is available. In practice webchat is often faster than the phone in January, and it produces a transcript — which is worth having if the problem later turns into a penalty appeal.

Part of the confusion in this area is that HMRC is midway through replacing Government Gateway with GOV.UK One Login, and the two systems now sit side by side on the same sign-in page. GOV.UK's HMRC sign-in page offers both: Government Gateway with a user ID and password, or GOV.UK One Login with an email address and password.

The Government Digital Service has set out where this has got to. Its April 2026 account of the programme confirms that the public beta launched on 9 February 2026, and that "since February, a proportion of users who access HMRC services online for the first time have been directed to sign in or create sign in details through GOV.UK One Login". The intention is that One Login becomes "the standard route for everyone accessing HMRC services for the first time" over the following months.

What has not happened yet is the migration of people who already have and use a Government Gateway account. GDS names that as the next priority — "bringing existing HMRC users onto GOV.UK One Login" — without publishing a date. So for most readers of this page, in most cases, the account you are trying to recover is still a Government Gateway account and the Government Gateway routes are the ones that apply.

The practical consequence is that you must establish which credential you hold before choosing a recovery route. If you registered before February 2026 and have signed in with a string of digits, it is Government Gateway. If you registered more recently and sign in with an email address, it is One Login. If you hold both — which is entirely possible, because One Login is also used for services outside HMRC — recovering one has no effect at all on the other.

One Login recovery is a separate process with separate documentation. GOV.UK explains that you change your password, email address, phone number or default code method from Security, then 'Manage your sign in details', within your One Login. If you have lost access to the phone and have no backup method set, the route is to select 'Problems with the code', then 'Check if you can change how you get security codes' — and you may need to use the GOV.UK ID Check app to prove your identity before you get back in.

One Login also has something Government Gateway does not: a dedicated support team with its own number. GOV.UK One Login publishes 0300 373 9020, or +44 208 629 0008 from outside the UK, open Monday to Friday 8am to 8pm UK time, with webchat over the same hours and a contact form answered within two days. Have your reference code ready if the service gave you one.

Note also that One Login does not yet cover everything. GOV.UK is explicit that it works with some government services and not all, and Universal Credit is specifically excluded. The NHS App and UKVI immigration accounts are separate systems again. Assuming that one recovered account fixes everything is the mistake that follows from the marketing rather than from the rollout.

Company accounts fail differently. An HMRC business tax account is built around an administrator who can add team members and control which taxes and schemes each can see. GOV.UK's guidance on managing team members describes the administrator signing in, selecting 'manage account' and then giving a team member access to a tax, duty or scheme. HMRC's separate guidance for Government Gateway super users goes further: super users can add and remove team members, reset team members' passwords, resend Government Gateway user IDs, and set up multi-factor authentication, while standard users can do none of that.

That structure creates the worst lockout on this page: the sole administrator has left the business, and nobody remaining has the rights to add themselves. There is no online self-service fix for it, because the whole point of the permission model is that a standard user cannot promote themselves. The route is the online services helpdesk, with the company's own references to hand, and it takes time. The lesson for anyone still holding the credentials is blunt — appoint a second administrator before you need one, and do it while the first one is still employed.

For individuals, HMRC's trusted helper service is a much smaller but useful tool. GOV.UK explains a trusted helper can help someone check they are paying the right Income Tax and check or update their personal tax account, that the person being helped must accept the registration within 28 days, that help runs for 90 days before re-registration, and that you can help up to five people at once — while "the person you're helping is still legally responsible for their own tax". It is not a substitute for account recovery, but it can get a task done while recovery is in progress.

For anything more substantial, an authorised agent — an accountant or tax adviser — can file on your behalf through their own agent services account, which is entirely separate from yours. If you are locked out days before a deadline and already have an accountant, ask them whether the authorisation they hold lets them file without you signing in at all. Very often it does.

Now the part that actually matters: the deadline does not move. GOV.UK sets it out flatly — an online Self Assessment return must be submitted "by 11:59pm on 31 January" or a late filing penalty follows, and the tax is due the same night. The penalties are fixed and escalate: £100 immediately, daily penalties of £10 a day after three months up to £900, then a further 5% of the tax due or £300 (whichever is greater) at six months and again at twelve. Late payment penalties of 5% of the unpaid tax apply at 30 days, six months and twelve months, plus interest.

If a sign-in problem genuinely prevented you from filing, HMRC's reasonable excuse guidance is directly relevant. Its published list of accepted excuses includes "issues with HM Revenue and Customs (HMRC) online services" and a computer or software failure while preparing an online return. But it also states, equally plainly, that finding the HMRC online system too difficult to use does not count — and that you must send the return or payment "as soon as you're able to". A two-hour lockout on 30 January is not going to persuade anybody; a three-day identity verification failure with a timestamped webchat transcript might.

So build the evidence as you go. Screenshot every error message with the date visible, note the time and reference number of every call, keep the webchat transcripts, and keep the emails HMRC sends about your account. Then file by any route available — through an agent, on paper if the paper deadline of 31 October has not passed, or as soon as access is restored. Filing late and appealing is a far better position than not filing at all.