What to do if you are locked out of myGov

Start by naming the failure, because the sign-in page presents several different states that look much the same from outside. The five that matter: the account is temporarily locked; you have forgotten the username or password but your email and mobile still reach you; your multifactor method has gone with a device; your secret questions are gone; or the email address the account is built on is no longer yours. A sixth possibility — somebody else has been in the account — is dealt with at the end.

A locked account is its own state and it is the one people most often misdiagnose. myGov says plainly that an account may be locked if the password is entered incorrectly too many times, and that if wrong passwords or codes keep being entered the account can be locked permanently. Critically, while the account is locked you cannot sign in with your Digital ID, a passkey or the myGov app either. That surprises people who assume the shiny new sign-in method is a way around the problem — it is not. The lock sits in front of all of them.

A forgotten password with working contact details is the easiest case and it does not need a phone call. myGov runs separate Forgot username and Forgot password flows, and both work by sending something to an email address or mobile number already registered to the account. If you can still receive on either, you are minutes from being back in, and the only real risk is locking yourself out by guessing first.

A missing second factor is the hard case, and the most common serious one. If your sign-in method is a code sent by SMS to a number you have given up, a code from an authenticator that was on a stolen phone, or a passkey that lived only on a device you no longer have, knowing the password is not enough. And you cannot update the mobile number on the account without first signing in — the details you need to change sit behind the door you cannot open.

Forgotten secret questions are a milder version of the same trap. myGov sets three at account creation and describes them as an additional sign-in option for when other multifactor methods are unavailable. They are the fallback that does not depend on a device, but they carry a limitation: myGov states that to reach services such as the ATO or the NDIS you need a different multifactor option, so secret questions get you into myGov rather than all the way through it.

A lost or compromised email address is the most serious of the ordinary failures, because the email is both a recovery channel and, frequently, the username. Each myGov account must have a unique email address, and the same address cannot serve two accounts. If the mailbox belonged to an old employer, an internet provider you left, or a service that has closed it, the reset paths have nowhere to send anything.

Finally, be honest about the timing. If you got locked out immediately after clicking a link in a message about a refund, a Medicare rebate or a Centrelink payment, treat this as a possible account takeover rather than a routine lockout and read the last section first. The recovery steps are similar; the urgency, and the list of people you need to tell, is not.

If the account is temporarily locked, the unlock is self-service and it is short. myGov's sign-in help sets out the sequence: enter your myGov username and password on the Sign in page, select Unlock your account now, enter your security code, answer your secret question, then enter a new password. The lock is released as part of setting the new password, so the process ends with you signed in rather than back at the start.

Notice what that sequence assumes: that you know the password, since the flow begins by asking for it, and that you can both receive a security code and answer a secret question. If either is missing, this is not your path — go to the sections below on missing second factors and Strong myID recovery. Grinding away at the unlock screen without the code achieves nothing but more failed attempts.

Have the new password composed before you start, because a rejected password sends you back through the same screens. myGov requires between 10 and 64 characters with at least one letter and at least one number, will not accept repeated or sequential characters, and will not let you reuse a previous password. Passwords are case sensitive and may contain spaces and the characters ! @ # $ % ^ & *. Write it out in full first rather than inventing it under pressure at the prompt.

The detail that trips people is the one already flagged: myGov states that you will not be able to sign in with your Digital ID, passkey or the myGov app until you unlock the account. If you have carefully set up a passkey precisely so that a forgotten password would never matter, a lock still blocks it. The unlock has to be done through the username-and-password route, which is why keeping the password recoverable matters even after you have moved to stronger sign-in methods.

If the account has gone past a temporary lock and the password has been disabled entirely, self-service ends. myGov's Digital ID recovery page says that where your password is disabled you need to contact the helpdesk to have it restored before you can connect a myID for recovery. That is a phone call, not a form, and it is covered in the helpdesk section below.

One mechanical thing to plan around: myGov signs you out automatically after 15 minutes of inactivity, so assemble everything — password, phone, secret question answers — before you open the sign-in page rather than hunting for a document mid-process.

Once you are back in, do not simply close the tab. Fix the underlying fragility while you have access: add a passkey, connect a Digital ID, confirm the mobile number on the account is one you still hold, and run the security review myGov offers, which generates a personalised list of actions. A lockout that has just been resolved is the cheapest possible time to make the next one impossible.

The username problem is usually a mirage. myGov displays your username on screen when you create the account and emails it to you at the time, and an account can be set up so a registered email address or mobile number works as a username too. So more than one string may get you to the password prompt, and the one you remember may not be the one currently switched on — myGov's security guidance notes that it will turn off your email address and mobile number as usernames in some circumstances to protect the account.

If none of them work, use Forgot username. You select Forgot username on the sign-in screen and enter an email address you may have registered to the account; if it matches, myGov emails you the username. Do this before anything else, because it is free of consequence — nothing locks, nothing resets — and it separates not knowing the username from not knowing the password, which are different problems with different fixes.

For the password itself, select Forgot password and enter your username, email address or mobile number; myGov sends a code to the contact details on the account so you can sign in and set a new one. It works whenever at least one registered channel still reaches you. Record the new password somewhere durable rather than somewhere clever.

If the code does not arrive, work through the ordinary causes before assuming the account is broken. myGov's sign-in help points at checking the username was entered correctly, checking phone reception, checking the device has storage space for a new message, checking the email spam folder, and updating the device software. Codes go to whichever channel is registered, so one you expect on a mobile may be sitting in an inbox.

Once you are signed in, deal with the secret questions properly rather than leaving them as a vague memory. Three are set at account creation, answers are not case sensitive, and you can change them from Account settings by selecting Secret questions, then Manage, then Edit, verifying your identity and entering new answers. Choose answers that will still be true and still be memorable in five years — the point of failure is almost always an answer that was accurate at the time and has since changed.

Then change the thing that caused the problem. If you are here because a password you use elsewhere stopped working, note myGov's own advice that you should never use the same sign-in details for myGov that you use with other online platforms, and that once a passkey or Digital ID is in place you can turn the password off entirely, which stops stolen usernames and passwords being used against the account at all.

This is the failure mode that generates most of the phone calls, and it has a circular quality that makes it feel worse than it is. Your sign-in method is a code by SMS or an authenticator, the device is gone or the number has been given up, and every screen that would let you change it — contact details, secret questions, passkeys, Digital ID — sits inside Account settings, which is behind the sign-in you cannot complete. There is no way to redirect the codes from outside.

Work out first whether any other factor is still standing. myGov supports four multifactor methods — a Digital ID, passkeys, authenticators and codes by SMS — and treats secret questions as an additional sign-in option for when none of those is available. Secret questions are the only one that lives entirely in your head, which is exactly why they survive a lost handset, and why the previous section spends time on keeping them current.

Passkeys behave better than people expect, but only if you understand which kind you hold. myGov allows up to three, and distinguishes a synced passkey, saved to a password manager and available on every device signed in to that manager, from one saved to a physical security key or a single device and usable only there. A synced passkey survives losing the handset, because it really lives in your Apple, Google or password-manager account. A device-bound one does not, which is why myGov suggests registering more than one security key so a lost or stolen key does not end your access.

There is an asymmetry here worth planning around. Every self-service route back into myGov ends by delivering something to an email address or a mobile number, or by asking you to authenticate on a device. If the only two channels on your account are one mobile number and an email account you read on that same phone, a single lost handset takes out both at once. Two channels on two devices is the difference between an inconvenience and a helpdesk call.

If none is standing, go to the next two sections in order: a myID at Strong identity strength is the recovery route myGov publishes for exactly this situation, and the helpdesk on 132 307 is what follows if that route is closed to you. Do not spend another twenty minutes at the sign-in screen — nothing there will help, and repeated attempts can lock the account on top of everything else.

If you are travelling, do the preparation before you go rather than from a hotel room. A phone that cannot receive an Australian SMS abroad is functionally the same as a lost phone as far as myGov is concerned, and the methods that do not depend on receiving a text — a passkey, a connected Digital ID, or secret questions — are the ones to have working before you leave. Retrofitting any of this from overseas, on a foreign SIM, is materially harder than doing it at home the week before.

When your sign-in method is unavailable, myGov's published recovery route is a Digital ID. The requirement is specific: the myID must have a Strong identity strength, and your name, date of birth and email address in your myGov account must match your details in myID. There is a further condition that catches people out — myID cannot already be connected to that myGov account for the recovery flow to be offered, because if it were connected you would simply be signing in with it.

The sequence itself is short once the myID exists. Go to myGov and sign in with your username and password, select the option that says you cannot use your sign-in method, choose Continue with Digital ID and select myID as your identity provider, enter your myID email address and log in, authenticate in the app with your password, fingerprint or face, enter or accept the four-digit code the app shows, then review your details and give consent.

Getting the myID to Strong is the real work. You must be 15 or older. You download the myID app, enter a personal email address you will keep ongoing access to, create a password, and provide your full name and date of birth. Standard strength requires verification of any two Australian documents from a list that includes a passport, driver licence, birth certificate, visa, ImmiCard, citizenship certificate and Medicare card. Strong adds a photo check on top of that.

For Strong there are two published routes and both hinge on a photo. The passport route verifies an Australian passport — current, or expired by no more than three years — together with a face verification check and one further document. The alternative is open only to Western Australian driver licence holders, who can verify the licence and photo alongside a Medicare card and one other document. If you hold neither an Australian passport nor a WA licence, Strong is not available to you, and that single fact decides whether self-service recovery is on the table at all.

The face check is a one-off liveness and match step: the app guides you through confirming you are a real person, the right person, and verifying in real time, comparing a selfie against the photo on the document. It is the part of the process most likely to need a second attempt, so give it decent light and a stable surface.

Two myID traps deserve naming, because both are self-inflicted and both feel permanent. First, setting myID up on a new device means selecting I am an existing user and entering the same email you used before — a different one locks your myID across every device, and fixing that needs a device that still has app access. Second, identity strength is unique to each device, based on the documents verified there, so a myID that was Strong on your old handset is not Strong on the new one until you redo the work.

If your myGov password has been disabled rather than merely forgotten, this route is blocked until the helpdesk restores it, because the flow begins by entering a username and password. And keep the legal position in view: under the Digital ID Act 2024, creating and using a digital ID is voluntary, and accredited services must be accessible and inclusive. A Digital ID is the fastest way back in. It is not something you can be required to hold.

The myGov helpdesk is the human fallback and the number is 132 307. Its published hours are Monday to Friday, 7am to 10pm and Saturday to Sunday, 10am to 5pm in local Australian time zones, and it is closed on national public holidays. From overseas the published number is +61 1300 169 468 for both mobile and landline callers. Calls to 13 and 1300 numbers from a landline cost the same as a local call; from a mobile the cost is set by your provider.

Be clear about the boundary. myGov states that the helpdesk can only help with your myGov account — signing in and using the account itself. Anything that is really a problem with a service behind it, such as an ATO identity question, a Centrelink task or a Medicare claim, belongs to that agency, and myGov's contact page lists the services separately for exactly that reason. Calling the wrong one costs you a queue.

Two things the helpdesk can do that nothing else can. It can restore a password that has been disabled, which is the prerequisite for the Strong myID recovery flow described above. And it can release an email address attached to an account you can no longer use, so the same address can be used to create a new one. Both are documented on myGov's own help pages, and both are the reason to ring rather than keep experimenting.

Have your identifiers assembled before you dial, because an identity conversation conducted while you rummage through a drawer goes badly. Bring the myGov username if you have it, every email address you might have registered, the current mobile number and any previous one, and the identity documents government identity services actually verify — an Australian passport, a driver licence, a birth certificate, a citizenship certificate, a visa or ImmiCard, and a Medicare card. Having several available matters more than having any particular one. Add your tax file number and Centrelink Customer Reference Number in case the call ends in a referral.

If you are calling on behalf of somebody else, plan for it. myGov states that even where you are a nominee or an authorised representative you will need the other person with you when you call. That is a real scheduling constraint for anyone helping an elderly parent or a family member with limited English, and it is much easier to arrange in advance than to discover at minute forty of a hold queue. For questions that are not about proving who you are, myGov also runs a digital assistant reachable from the Assistant icon on any of its pages, which is quicker than the queue.

myGov says it directly: if you cannot recover your account using a Strong myID, you will need to create a new one. That is where the problem changes shape. You are no longer recovering access, you are rebuilding it, and how you do that decides whether you end up with one working account or two half-working ones.

Deal with the old account first. Because each myGov account must have a unique email address and the same email cannot be used on two accounts, you either use a different email for the new account or ask the helpdesk to release the old one. Releasing it is the better outcome where the address is your long-term personal email, and it is a call to 132 307 rather than something you can do yourself.

Understand what closing an account does. myGov's guidance is that closing it unlinks all of your services and you lose access to the messages in your myGov Inbox, and that closing is permanent. Those inbox messages include things people go looking for later — notices, statements and correspondence from linked agencies — so if you can still get into the old account at all, save what you need out of it before you close anything.

Then build the new one deliberately. Creating an account with an email runs: select Create a myGov account, select Continue with email, agree to the terms of use, enter and verify the email address, enter and verify a mobile number, create a password, set three secret questions and answers, and receive your username on screen and by email. Set the strongest sign-in method you can as soon as it exists, rather than leaving it on a password and an SMS code and repeating the original problem.

Now the part that decides everything: relinking. A new myGov account does not create new records at the ATO, Centrelink or Medicare, and it does not carry your old links across. Each agency runs its own identity check before it will attach its record to a myGov account, which is the same process you went through the first time. Budget for that rather than assuming the new account will populate itself.

The duplicate-account trap is worth stating plainly. If an abandoned myGov account is still linked to your agency records and you build a second one alongside it, you have two front doors to the same records, only one of which you can open, and correspondence may keep arriving in the inbox you cannot reach. There is no self-service merge button. Resolving it means the helpdesk and, on the agency side, the linked service.

So the order matters more than the speed: get the old account recovered or properly closed and its email released, then create one new account, then relink each service one at a time.

If you suspect the lockout followed unauthorised access rather than your own forgetfulness, the check is specific. myGov's guidance on unauthorised access says to review your account history, your linked services and your connected devices, and to watch for new services having been linked or existing services having gone missing. It singles out bank account details held inside linked services as a common target, which is the change that actually costs money.

Account history is where you look, and it is worth looking early. It records activity such as signing in and changes to account settings, and myGov also sends notifications when you sign in from a new device or change some settings — so an unexplained notification is evidence, not noise. Because the history covers a limited number of recent activities rather than the account's whole life, a fortnight spent trying to get back in can push the entries you needed off the end of it.

If you cannot secure the account yourself, myGov's own advice is unusually direct: contact the helpdesk, and where the account cannot be secured, the safest step is to close it, create a new one, and relink your services using the strongest sign-in option available to you, such as a Digital ID or passkeys. That is the same rebuilding process described in the previous section, with the added urgency that somebody else may still hold the credentials.

If you gave your sign-in details away — to a fake sign-in page, a caller, or a message you now regret — myGov's scam guidance is to call the Services Australia Scams and Identity Theft Helpdesk, set up multifactor authentication such as a Digital ID or passkeys, change your password, review your account history, work through the security review tasks, and remove any connected devices or passkeys you do not recognise. If the scammer could have reached your linked services, contact each of them — the ATO, Medicare, Centrelink — separately, and your bank if card or banking details were shared.

Where a device rather than an account was compromised, the sequence differs again. myGov's recovery guidance says to run a virus scan and remove any malware, contact your bank, contact the ATO and Services Australia about your personal information, change the password on every account someone could reach including bank, superannuation, myGov and email, warn your contacts about strange links, and report it through ReportCyber on the Australian Cyber Security Centre website. It also points to IDCARE, the not-for-profit identity and cyber support service, for free cyber first aid.

Then close the loop on prevention, because otherwise the account you rebuild is the one you will be locked out of next time. myGov's protection guidance recommends multifactor authentication, treats a Digital ID and passkeys as the strongest options, and makes a point most people miss: once one of those is in place you should turn the password off, which stops stolen usernames and passwords being used against the account at all. It also advises turning off your email and mobile as usernames, and never reusing myGov sign-in details elsewhere.

Finish with the two things that make a future lockout survivable rather than catastrophic. Hold more than one recovery factor — myGov allows up to three passkeys, and a synced passkey in a password manager survives a lost handset in a way a device-bound one does not — and keep the contact details on the account current, because every self-service reset described here ends by sending something to an email address or a mobile number. Run myGov's security review as a five-minute annual job, not an emergency measure.