Two-step verification now mandatory on HMRC business tax accounts

HMRC has provided the following update on two-step verification for businesses:


HMRC update 

“From September 2017, HMRC will make it a requirement for all businesses using their online tax accounts to register for 2 Step Verification (2SV) – if not already using it. The result of this minor change means greater security for customers and a safer experience when using our online services. 

Users logging into their tax accounts from September will be asked to register for 2SV – it is quick and easy to setup. 

What is 2SV?

2SV is a way of adding a layer of security to customer’s Government Gateway credentials. Instead of relying on something you ‘know’, like a User ID or Password, we add in the extra factor of something you ‘have’, a mobile or landline. 

Is 2SV new?

No it isn’t. The use of 2SV is backed by the National Cyber Security Centre and promoted by Cyber Aware and Action Fraud. 2SV is used widely across well-known brands in the tech industry, it’s also commonly used for online banking. 

HMRC began introducing 2SV in December 2015 and, since then, more than 11 million individuals and businesses have successfully set up 2SV to protect their online tax accounts. 

Why is HMRC requiring 2SV for businesses?

HMRC takes the protection of customer data extremely seriously. We are a well-known brand because of our unique tax collection role. Similar to other large financial organisations, that makes us an obvious target for fraudsters and cyber criminals. 

Threats evolve and change, so we are constantly reviewing our security approach to ensure everything is done to keep businesses secure. 

If you encounter issues using 2SV with HMRC, please contact our Online Services Helpdesk


The Tax Faculty comments

2SV has been mandatory for Personal Tax Accounts for some time and this latest change extends this to Business Tax Accounts. Agent access to the agent portal is unaffected. 

The Tax Faculty has received a number of comments from members about difficulties with receiving codes – in areas where there is poor mobile phone reception and by overseas businesses in particular. It is possible to have the code sent to a landline and HMRC’s app can now be used to generate the required security code if an internet connection is available. 

We would be interested in the experiences of you or your business clients in the 2SV process for Business Tax Accounts. Please comment below. 

  • 2SV should only be needed for the first time logging on from a new device - not every time I logon. If that is good enough for the banks, it should be good enough for HMRC.

  • On the bright side, it is giving me great exercise. I log on, and then have to run to the bottom of the garden to catch a mobile signal and a few minutes later the code comes through (and that is in Sussex).

    Ian Dalzell is right, but it's about more than security - they want to know who you are and where you are logging in from of course. We are all being tracked. It's not about the use of data  - it's about data's use of us.

  • Never mind being abroad! What about those who live and work in areas where there is no mobile signal (e,g parts of Cumbria)? I don't answer my landline phone to numbers I don't recognise and the unclear American voice used by HMRC to provide the access number starts speaking during my Answer machine message so is next to useless and even when I pick up the phone I have difficulty hearing the numbers. How does one get access to a HMRC app? (and what's the point (on security grounds) if one is using the same computer to log on). Until extreme pressure is put on the Government to give us "in the sticks" more access to IT technology (and they are in place), these imposed restrictions should be made voluntary.

  • What if you're on holiday overseas using a cheap holiday sim card to avoid horrendous charges?  This would involve calling them to change the registered number (if you can get through) and then calling again to change it back.on your returnto the UK