A regular query from clients is that they are unable to access their government gateway (VAT portal) because they have forgotten their UserID, their password, or both. It is also increasingly common to find taxpayers who know their UserID and password but then get stuck at the 2-step security stage.
Why it matters
Often, the 2-step security code goes to a mobile phone and unless the holder of the mobile reports back with the security code, the taxpayer is not getting in.
Usually what triggers this problem, is an employee leaves the business and takes their personal mobile with them or if it is a business mobile, the contract may be cancelled/stored in a cupboard.
Increasingly as people are operating under hybrid working arrangements, it can be easy for a key employee to be away from their (home)/desk or be on holiday.
Where an employee is dismissed or leaves suddenly, there may well be a procedure for collecting company equipment and records before the employee departs but is the exit process sufficient to also ask for details of the HMRC gateway 2-step security access?
It should be a matter of routine IT policy to change the log in password regularly and more so when an employee who had access leaves the business.
The HMRC gateway is a business critical risk – although often it is not seen as such – but without access to the gateway, the business cannot file VAT or other returns, if unauthorised people can get access, they could change bank details or issue refunds to themselves.
Security codes
For a taxpayer, perhaps a landline (such as reception) makes sense, and whether the reception/main line is staffed at the office or remotely, the security code will be received and can be passed onto the person who requested the code.
A mobile may also make sense for a smaller business but you need to consider who holds the mobile and how they can be contacted if they are not in the office/working from home, also, don’t forget that whilst the 2-step security may seem an annoyance, it is the last gateway to accessing your VAT account (and other taxes) and an unauthorised person can change bank details or address and submit a VAT refund to their designated bank (albeit an extreme example).
There is also an app/authenticator which offers another route for receiving the security code.
Resetting access
If the business has forgotten the UserID and/or password, there is an automated process that takes you through some questions about the business (such as the figure in Box 5 of the last VAT return) and if answered correctly, can be reset/access gained online/automatically.
Don’t forget that the government gateway contains a lot of details about the business, payroll, VAT, taxes, and this information needs to be protected, which is why HMRC don’t necessarily make it easy to reset things.
There is no simple online way to change the 2-step security code, the only method is to contact HMRC. HMRC offer a live helpline (telephone) and a live webchat helpline (from June 2022). More details can be found here.
HMRC will need to confirm that they are speaking (or web chatting) to the business and HMRC will ask a number of security questions. HMRC usually ask 3-4 questions and if you can answer them correctly, you will pass the identity checks.
The questions could be :
- Confirm VAT number
- Confirm the date you were registered for UK VAT (Effective Date of Registration)
- The last VAT return period you filed
- The Box 5 value on that last VAT return.
- Name of a Director (shareholder) of the business
- Address of the business
- HMRC will never ask for bank details but they may ask on what date you last paid HMRC or last date HMRC refunded VAT to the business.
- Once you pass the security checks and HMRC are happy they are speaking to the business, then HMRC will remove the existing telephone number from the system.
- You then log into your gateway as normal but once you enter the User ID and password, it will then ask you to set the method for 2-step security and it is here that you can then enter a new number or opt for authenticator app access, you will then be sent a code to the telephone/app to confirm things are as expected and then you can access your VAT account as normal.
Whilst this article is written from the perspective of Government Gateways relating to VAT returns/VAT Access, the same procedure is required if your Gateway is for PAYE, Personal or other taxes, with a set of security questions appropriate to the tax you are enrolled for.
For more details of our VAT services, then please follow this link VAT Accountants in London & Hertfordshire
Sign up to our newsletter
Join our mailing list to receive regular updates on
the news and events you need to know about.