How to recover your ATO online services access

Before you phone anyone, establish which of four things is actually happening. The wrong diagnosis is expensive here, because the myGov helpdesk cannot fix an ATO identity problem and the ATO cannot reset a myGov password. Each layer has a different owner, and the person who answers the phone will only be able to help with theirs.

The first test is whether you can sign in to myGov at all. If the username, password, SMS code, authenticator, passkey or secret question is the sticking point, that is a Services Australia problem, and the myGov helpdesk on 132 307 owns it. If none of the built-in fallbacks work, the recovery route is a Strong myID, and after that a new account.

The second test is whether you can sign in but the ATO is not there. If it does not appear under your linked services, or you see a 'Cannot find link' message moving from myGov to ATO online services, the account is fine and the link is the problem. The ATO's guidance for that message is slightly counterintuitive: go to 'View and link services' and check the status, and if the ATO shows as linked but will not open, unlink it, wait for the confirmation, then link it again.

The third test is whether you can sign in, the ATO is linked, and the ATO still refuses. Error codes OAS.001 and OAS.002, and the message 'your sign-in method doesn't meet minimum access requirements', are not identity failures. They mean you previously signed in with a myID and set an online access strength, and the method you are using now is weaker than the one the ATO recorded. Nothing is wrong with your record; the ATO is holding you to a standard you set yourself.

The fourth test is whether you are refused with no useful message at all. The ATO's help page describes an 'unable to log in' state that follows a data breach or suspected fraud, where protective measures have been applied to your record. Online channels may be closed to you, pre-fill data may be unavailable, and the only way through is the Client Identity Support Centre on 1800 467 033.

Whatever happens, write down the exact error code before you close the window. The ATO's help page for individuals is organised by code rather than by symptom, and the families tell you a great deal at a glance: IDD codes mean your personal details do not match the ATO record; the NOA, BANKACC, SUPERACC, PPS and TAXREF family means a specific answer did not match; LCK codes mean a temporary lockout after failed attempts; OVK.001 means your sign-in method is not supported for linking; and IDD.003, ICI.001 and OVK.002 mean the process cannot be completed online at all.

Linking the ATO is four steps: sign in to myGov, follow the prompts to link, confirm your personal details, and answer questions confirming your identity. Everything difficult happens in the fourth step, because the ATO draws those questions from information it already holds — which means the questions you get depend entirely on what kind of taxpayer you have been.

The published list of what the questions may be drawn from is broader than most people expect, and it is worth reading before you start rather than after you have failed. It runs from the obvious — a notice of assessment, a bank account, a super account, a PAYG or Centrelink payment summary — to the ones nobody thinks of, including a TFN application lodgment receipt, an active ATO payment plan, and a recent payslip. You will not be asked about all of them; the ATO picks from what it has.

Each record type carries its own age limit, and this is where people are caught out — a notice of assessment must have been issued in the last five years, a payment summary in the last two financial years, a travel document in the last four. The table below sets out each one. Pulling a document that is a year too old is the single most common reason a person who genuinely has the right paperwork still fails the check.

Get your personal details into the right format before you start, because a share of failures are formatting rather than fact. The ATO asks for a nine-digit tax file number with no spaces, and the first 40 characters of each of your given and family names. If you have one name only, it goes in the family name field and nowhere else.

You can skip a question you are unsure about, and the system will offer another. What you cannot do is skip all of them: the ATO states plainly that skipping every available question counts as a failed attempt, which spends one of your tries for nothing. If you are down to guessing, stop, find the document, and come back.

Two traps are worth naming. If you lodge through a tax agent, your refund may have gone to the agent's account rather than yours, so the bank account question is about an account you have never seen. And answers must match what the ATO holds, not what you remember — pull the actual document.

When you run out of attempts you will see an LCK code and a stated time and date at which you can try again. There is no way to shorten that window; the ATO's advice is to wait for the lockout to expire. Use the wait to assemble better paperwork rather than to rehearse the same answers.

The identity check assumes a paper trail. First-time lodgers, people who arrived in Australia recently, students who have never earned above the threshold, and anyone whose refunds have always gone to a tax agent frequently have no usable answer to any of the questions, because the ATO holds almost nothing about them to ask about.

Look first at the records that do not require a lodgement history. A recent payslip counts. An active super account counts, and most people who have worked at all in Australia have one even if they have never thought about it — the details are on a super statement, a payslip, in the fund's app, or available by phoning the fund. A TFN application lodgment receipt counts, and a travel document counts if you applied for your TFN as a permanent migrant or temporary visitor within the last four years.

If none of those exist, the better route is not to keep guessing but to change the door you are knocking on. The ATO recommends signing in to myGov with a myID set up to Standard or Strong identity strength, and says plainly that doing so can simplify the linking process. A Standard myID is built from any two Australian identity documents — passport, driver licence or learner permit, birth certificate, visa using a foreign passport, ImmiCard, citizenship certificate, or a Medicare card, which appears as an option once you have verified one of the others.

That combination is achievable for a lot of people with no tax history at all — a Medicare card plus a driver licence, or a visa plus a Medicare card, gets a recent arrival to Standard without ever having lodged anything. The proof shifts from 'what does the ATO know about you' to 'what documents can you verify', which is a question people in this position can actually answer.

When the online check cannot be completed, the ATO says it will tell you what to do next, and for the terminal error codes that means phoning. The individuals line is 13 28 61, open 8 am to 6 pm Monday to Friday. Have your TFN ready and expect an identity check on the phone too — the ATO asks questions from information it holds, which may include details from letters it has sent you, figures from a tax return, payment or refund amounts, employment, superannuation or investment details, and confirmation of a driver licence, Medicare card or passport. If you expect to call again, ask to enrol a voiceprint while you are on the line.

If the sign-in itself is the problem, exhaust the built-in options first — a forgotten username, a forgotten password, a missing SMS code, an unreachable code generator app and a locked account all have their own self-service flows on myGov, and the helpdesk on 132 307 handles the rest. This page is about the ATO end, so what follows is the point at which those options run out.

When none of those work, the recovery mechanism is myID. The ATO's guidance is explicit: if you used a code sent by SMS, a secret question, a passkey or an authenticator as your sign-in method, you can use myID to recover the account, and to do that the myID must be set up to Strong identity strength. Your name, date of birth and email address in myGov must match the details in your myID; if they differ, update them in the myID app before you attempt recovery.

The recovery flow itself is short. Go to the myGov sign-in page, enter your username and password, select 'I didn't get my code', 'I can't access my app' or 'I can't answer my question', choose 'Continue with Digital ID', then sign in with your myID and follow the prompts. Once you are back in, the ATO notes that reaching ATO online services with that Strong myID also sets your online access strength, which is a protection you then have to maintain.

Now the constraint that decides whether this route is open at all. Reaching Strong identity strength requires verifying a photo as well as documents, and myID states you need an Australian passport to do that — or a Western Australian driver licence, the only state licence that supports photo verification. A current Australian passport, or one no more than three years expired, is the ordinary key. If you hold neither, Strong is unavailable and the myID recovery route is closed however organised you are.

Where Strong is out of reach, the ATO's advice is to use a Standard myID as your ongoing sign-in method — more secure than a code by SMS, and it simplifies linking — but that does not recover an existing locked account. For recovery specifically, the remaining option is a new myGov account, and the ATO says so directly: if you cannot recover using a Strong myID, you will need to create one.

Creating a new account is not the disaster it sounds like, provided you do it deliberately. You can use a different email address, or keep the same one by phoning the myGov helpdesk on 132 307 and asking for it to be released from the old account first — do that before you start, because an email attached to an account you cannot open will be rejected, and people respond by creating a third account with a throwaway address they later lose too. Your ATO record is not held inside myGov, so nothing happens to your tax history, lodgements or notices; what you lose is the old inbox and the links to every other service, each of which has to be re-established separately.

One setting decides whether you ever have to do this again. Once you are back in, go to My account, then Account settings, then Sign in settings, and add a backup sign-in option — the ATO's own advice for anyone not using myID. It is the single change that converts a future lockout from a week-long problem into a two-minute one.

Online access strength is an ATO concept, not a myGov one, and it catches people who have done everything right. The first time you reach ATO online services using a myID, the ATO records the strength of that sign-in — Strong, Standard, or 'not set' if you arrived by SMS code, passkey or the myGov code generator app. From then on, the ATO expects the same standard or higher every time. You can see the current setting under Personal details in ATO online services, or My details in the ATO app.

That is why a brand-new phone can lock you out of the ATO while myGov works perfectly. Identity strength in myID is unique to each device, based on the documents verified on that device. Set the app up on a new handset without re-verifying to the level you previously reached and the ATO will refuse you with OAS.001, OAS.002 or a minimum-access message, even though nothing has changed about your record. The fix is to re-verify on the new device to the same strength or higher, using the documents you used before.

Setting up myID on a new device has its own rule that breaks accounts if you get it wrong. Download the app, select 'I am an existing user', and enter the same email address you used before. myID states that entering a different email will lock your myID and you will be unable to use it — on every device, not only the new one. If you are unsure which address you used, search your inbox for messages from [email protected] or [email protected] before you type anything.

There is a related failure that looks like nothing at all. If you transferred the app from an old phone through a device migration and were never prompted to re-verify your identity, the app will appear to work and then throw errors when you try to reach online services. The documented fix is to open the app, select More, select Reset app, and set up again as an existing user with the same email address.

Disconnecting your myID from myGov, or unlinking from the ATO, does not reset your online access strength — it stays on your ATO record, and relinking later still requires a myID at the same strength or higher. Using a Digital ID is voluntary, and the ATO says that if you want to change the way you sign in you should phone the individuals line, but that conversation happens with the ATO rather than with myGov.

One more thing to check before you assume your account is broken: the myID app has minimum device requirements, and an older handset can fail in a way that has nothing to do with your identity. If the app itself is the problem — a locked app, a failed face scan, a document that will not verify — myID runs its own support line, listed in the contacts below, and it is a different queue from both the ATO and myGov.

The IDD.002, IDD.004 and IDD.006 codes mean your details do not match the ATO's record, or that more than one record was found. In practice this is almost always a name problem, and it is common after marriage, divorce, a legal change of name, or because different agencies hold different combinations of your names.

Check what myGov thinks your name is first: My account, then Profile. There is a catch the ATO flags directly — those details only appear if you have Medicare or Centrelink linked. If what you see is wrong, the fix is with Centrelink or Medicare. If it is right and the link still fails, the ATO record is the one that needs updating.

myID adds a third version of your name, and a useful control over it. Your name in myID is taken from one of the documents you verified, and documents differ — a driver licence may hold only a first name and surname while a Medicare card holds a middle name too. Services differ the same way: myGov may hold first name and surname while the ATO holds all three. In the app, My identity then Identity details lists the name attached to each verified document, and you can select any of them.

If the name you need is not on any document you have verified, you may be able to verify a change of name with a change of name certificate — which myID accepts only from Tasmania, South Australia, the Northern Territory and the Australian Capital Territory — or with a marriage certificate. You will be prompted for the certificate details when you verify a document in your new name for the first time, or after resetting the app and setting up again with your previous name.

Updating the name on your ATO record is a separate job from updating it in myID, and the quickest route is online through a myGov account already linked to the ATO: under Linked services select Australian Taxation Office, then My profile, then Personal details, then 'Update name and title'. To move to a new name you need to verify an Australian full birth certificate (not an extract), an Australian marriage certificate, or an Australian change of name certificate. Switching back to a name the ATO has held before, or changing only your title, needs no document at all.

If you cannot get in online, the ATO can update a name or title by phone against the same three Australian documents, checking the details with the issuing agency. Where that is not possible — most obviously if your documents are foreign — you post the Change of details for individuals form with a certified copy of the original document. The ATO does not accept certified copies of digital identity documents, warns against posting originals because they may not be returned, and says it can take up to 28 days to update your records after the form arrives.

Finally, the unlink-and-relink move. Where the ATO shows as linked but will not open, the documented fix is to unlink, wait for the confirmation, and link again. Your tax record is untouched, but treat it as a real step rather than a reflex: relinking puts you back through the identity questions, so have your documents in front of you first. One unlink happens without you asking — if you set 'Answer a secret question' as your only myGov sign-in option, the ATO unlinks your account, because it treats that method as too weak for tax records.

There is a category of lockout that no amount of correct answers will solve, because it is deliberate. If the ATO believes your identity has been compromised — through a data breach, a suspected fraudulent lodgement, or unauthorised access to your myGov account — it applies protective measures to your record, and those measures restrict your own access as a side effect of restricting everyone else's.

The ATO publishes what the measures can involve. It may require additional proof of record ownership before discussing your affairs, and may ask you to contact it directly rather than through your tax agent. It monitors your record and may contact you or your agent to confirm activity is legitimate before processing continues, which delays returns and other forms.

Those effects are worth stating plainly, because they are disorienting if nobody has told you. You may lose ongoing access to ATO online channels and to myGov unless you hold a Strong Digital ID. Pre-fill data may not be available, so a return that used to complete itself now has to be assembled from payslips and statements. Business activity statements may stop issuing automatically, meaning you or your agent must contact the ATO before each lodgement so a statement can be generated. And your Digital ID may itself be suspended while the ATO investigates whether the compromise reached its online environment.

The single most useful thing to know is that a Strong myID is the documented way back to self-service. The ATO states that by signing in with a Strong myID you can unlock your access to ATO online services without needing to phone each time — and that to keep that access you must use the Strong myID every time you sign in. For anyone under protective measures who holds an Australian passport, setting up Strong is the difference between a phone call per interaction and none.

The right phone number here is not the general line. The Client Identity Support Centre on 1800 467 033, open 8 am to 6 pm AEST weekdays, is the ATO's front door for a stolen or misused TFN or ABN, for someone accessing your myGov account and linked ATO services without permission, for fraudulent updates to your record including changed bank details, and for a self-managed super fund set up or altered in your name. It is also the number to call if you have merely been notified of a data breach and want safeguards applied pre-emptively.

Have your identity documents ready before you call. The ATO says it will discuss which documents you need to provide, and that it will help you re-establish your tax identity, confirm and correct details that have been misused, and monitor your record before automatic processing of lodgements or claims. It also states that the security measures stay on your file until it determines there is no further risk — there is no fixed end date you can plan around. One parallel step is worth taking the same day: the ATO recommends contacting IDCARE on 1800 595 160 if other personal information may have been compromised, because reporting to the ATO alone addresses your tax record and nothing else.

Business access runs on a different track. Online services for business, Online services for agents, Access Manager, the Australian Business Register and several others require a Digital ID plus the Relationship Authorisation Manager, and myID is currently the only Digital ID the ATO accepts. Losing access to one of these is not a myGov problem and the myGov helpdesk cannot help.

The order of operations matters. The principal authority — a sole trader, an eligible individual associate listed on the ABN such as a trustee, director or partner, or a primary person where no individual is listed — must be the first to link the business to their myID in RAM, at Standard identity strength or above. Nobody else can be authorised until that has happened. Authorised users are then invited by email and have seven days to accept using their own myID before the code expires.

Sole traders occupy an awkward middle. The ATO's guidance is that they continue to use ATO online services through myGov for personal tax matters, while business functions run through Online services for business via myID and RAM — so a sole trader can be locked out of one and fine in the other, and the two are recovered separately.

There is a hard limit worth knowing before you plan around it. If no principal authority can reach Standard identity strength, the ATO states the business cannot use its online services and must lodge another way — through Standard Business Reporting-enabled software or a registered tax agent. Every staff member's myID belongs to them personally and must use a personal email address, so a business cannot solve this by creating a shared identity.

Being overseas changes which routes are open, and the numbers are worth saving before you need them. The ATO runs a dedicated line for people outside Australia who need help linking the ATO to myGov, on +61 2 6216 3444, 8 am to 6 pm Monday to Friday. General overseas tax enquiries go to +61 2 6216 1111, and the myGov helpdesk takes international calls on +61 1300 169 468, option 1.

The structural problem overseas is the Australian mobile number. The ATO's advice is to use myID, a passkey or an authenticator if you do not have one, are overseas, or have poor reception — and myID's advantage here is that it is not locked to a particular number or device, and can be set up again on a new phone with nothing more than an internet connection. Making that change before you leave is far easier than making it afterwards.

If the front-line channels have genuinely run out of answers, there is an escalation ladder and most people never use it. Lodge a formal complaint with the ATO first, on 1800 199 010, and keep the reference number — it looks like 1-XXXXXXXXXXX and the next step will ask for it.

The Tax Ombudsman is the independent step after that, and it is free. It will only investigate once you have complained to the ATO and remain dissatisfied, and it says that if there is no record of a formal complaint on the ATO's system it may transfer your complaint back. Its published list of what it can handle includes the timeliness of responses, whether facts, evidence and your circumstances were properly considered, the completeness of reasons for decisions, the conduct of ATO officers, and — directly relevant here — the availability of services such as ATO online. It cannot compel the ATO to change a decision, but access is a service question rather than a decision, which is squarely what it exists to investigate.