HMRC Login Changed October 2026: What to Do If You Are Locked Out

You are 42 or 44 or 46. You have a workplace pension, a mortgage, two kids, and a personal tax account on GOV.UK that you only remember exists in January. The new Multi-Factor Authentication (MFA) gate is the first thing you will hit when you go to check your tax code, your Self Assessment status, or your State Pension forecast this autumn.

The good news: getting back in is mechanical. The bad news: every week you leave it is a week you are adding to your January pile, when HMRC wait times balloon and identity verification queues stretch from hours into days.

What just changed

HMRC began rolling out mandatory Multi-Factor Authentication for personal tax accounts and Government Gateway logins from late September 2026. If you file Self Assessment, run a business, or use Government Gateway for PAYE, CIS, or VAT, this affects you. The change applies to three places:

• Personal Tax Account (used to check tax code, NI record, Self Assessment status)
• Government Gateway (used for PAYE, Self Assessment, CIS returns, VAT)
• GOV.UK One Login (the single login that now gates access to both of the above)

The logic is straightforward. HMRC is closing a security gap. Two-factor authentication has been standard practice for most online banking for years. Tax accounts contain sensitive financial data and are a high-value target for fraud. HMRC is catching up.

The friction is real too. The people most likely to be locked out are those who set up their Government Gateway ID years ago and have since changed phone number or email, who rarely log in (once a year is not enough to remember the process), or who did not realise MFA was being added because the rollout was not widely publicised.

How to get back in

If you are locked out right now, work through these in order. Most people resolve at step two.

Step 1: Use the "Forgotten Access" route on GOV.UK

Go to the GOV.UK sign-in page for the service you need. Select "Forgotten password" or "I have lost access to my account." HMRC will ask you to verify your identity using your National Insurance number, a recent payslip or P60 (for PAYE users), and a valid UK passport or driving licence for the full identity verification flow.

This is the standard recovery path. It works but it is slow. HMRC's automated systems can take 24 to 48 hours to restore access in October, and longer in peak periods. October is the calmest month of the year to do this. December is not.

Step 2: Use the HMRC app if you already have it set up

If you have the HMRC app already installed and authenticated on your phone, the app can sometimes bypass the new MFA gate on the web browser. It is not always promoted, but it is worth trying before going through full account recovery.

Step 3: Register for MFA properly once you are in

When you regain access, HMRC will prompt you to set up MFA properly. You have two options:

• Authenticator app (recommended, more secure and faster)
• Text message code (less secure, but easier if you have a stable mobile number)

Download a free authenticator app (Google Authenticator, Microsoft Authenticator, Authy) and scan the QR code HMRC shows you. Keep a backup: take a screenshot of the recovery codes and store them somewhere safe, not in the same place as your phone.

Step 4: If you cannot verify your identity online

If HMRC cannot verify your identity through the online routes, because you do not have a payslip to hand, your name has changed, or the system simply will not accept your answers, you need to call HMRC. The relevant numbers are Self Assessment general enquiries on 0300 200 3310 and National Insurance on 0300 200 3500. Opening hours are Monday to Friday, 8am to 6pm (wait times are shorter earlier in the day). Expect to spend 20 to 40 minutes on hold. Have your NI number, postcode, and a recent P60 or payslip to hand before you call.

For the full step-by-step walkthrough, see the HMRC MFA login help page.

The late-filing penalty stack

These are not HMRC being cruel. They are HMRC being consistent. But they are also entirely avoidable if you can get into your account now, rather than in the panic of 28 January.

• 1 day late: £100 fixed penalty
• 3 months late: £10 per day (up to £900)
• 6 months late: £300 or 5% of tax due (whichever is higher)
• 12 months late: £700 or 10% of tax due (whichever is higher)

A £10,000 tax bill filed on 1 February 2027 instead of 31 January 2027 costs you £100 the next day, up to £900 by 1 May, £500 more by 1 August, and another £700 or 5% by 1 February 2028. That is up to £2,200 in penalties on a bill that started at £10,000. The penalties are tax-deductible against the bill, but the cash still has to leave your account on the date HMRC asks for it.

There is a secondary cost that does not get discussed: every hour spent fighting HMRC login in January is an hour not spent understanding your actual financial position. The people who end up locked out in January are often the same people who then file quickly and inaccurately because time has run out. That carries its own risk, in the form of underpayment discovered three years later with interest attached.

What your HMRC account actually shows you

Here is the thing HMRC's new MFA gate is quietly exposing. For millions of people, the HMRC account is the only place they can see their complete tax record in one place. That single login shows your National Insurance record (years of contributions and State Pension forecast), your tax code history, your Self Assessment filing history, your PAYE record (if employed), and any CIS deductions (if a contractor).

It is a financial document. It contains your financial history. And for many people, it is the only structured financial picture they can access right now without setting up something else first.

The MFA rollout is, in that sense, a forcing function. It is asking you to do something you probably should have done years ago: verify that your identity is properly set up with HMRC, that your contact details are current, and that you know what your tax record actually says.

The one thing to do this week

Do not wait until January. Do this now: check whether your HMRC contact details are current. Log in to GOV.UK and verify that the email address, mobile number, and home address HMRC holds for you are all correct and accessible. If they are not, update them before you are locked out.

If you cannot log in at all, start the recovery process this week, not in December. HMRC's identity verification systems are faster in October than in January. Every week you delay is a week you are adding to your January pile.

Then, once you are in, set up the authenticator app. Not the text message option. The authenticator app. It takes five minutes and it means you will not be here again in October 2027.

Sources. GOV.UK, Sign in to your personal tax account. GOV.UK, HMRC app. GOV.UK, Self Assessment penalties for late filing. GOV.UK, Government Gateway user guide. GOV.UK, MFA rollout communications to personal tax account users, late September 2026. Figures cited at 30 September 2026. HMRC procedures and recovery times may change; if you cannot resolve online, contact HMRC directly on 0300 200 3310 (Self Assessment) or 0300 200 3500 (National Insurance).

For the step-by-step recovery walkthrough, see the HMRC MFA login help page. For what your January pay packet should look like once you are back in, see January pay packet tax code change. For the State Pension forecast you can pull from your NI record once you regain access, see State Pension 2026/27: why your tax bill is about to change.