Resetting your income tax e-filing password

Go to the e-Filing portal, choose Login, enter your user ID and then click Forgot Password. What appears next is the whole game. The Income Tax Department's Reset Your Password user manual lists six ways to complete a reset — OTP on the mobile number registered with Aadhaar, e-Filing OTP sent to the mobile and email held on your portal profile, bank account EVC, demat account EVC, upload of a Digital Signature Certificate, and e-Filing login through net banking. The screen you are looking at will not necessarily show all six.

The department states the reason explicitly in the same manual: the options available depend on the configurations enabled through the e-Filing Vault Higher Security service, which the user can change. So the reset screen is not a fixed menu. It is a reflection of decisions made on your own profile, possibly by you, possibly by whoever set the account up on your behalf.

Before you click anything, take stock of four things. Do you still receive messages on the mobile number and at the email address that the portal has for you? Is the mobile number registered with your Aadhaar one you still hold? Have you ever pre-validated a bank or demat account on the portal? Do you have an active DSC on a token in a drawer? Each yes opens a route, and each no closes one.

The OTP mechanics are the same across routes. The manual sets a fifteen-minute validity on the one-time password and allows three attempts to enter it correctly, with a countdown timer on screen and a resend option. Burn all three attempts on a code that arrived late and you start the flow again, which is a good reason not to attempt a reset while your phone is on a train with patchy coverage.

When a reset succeeds, the portal generates a Transaction ID and sends a confirmation to the email address and mobile number registered against the e-Filing account. Keep that transaction reference. It is the cleanest evidence of when access changed hands, which matters if you later have to explain to the department, or to a former consultant, who did what and when.

The new password has to satisfy the portal's policy — between eight and fourteen characters, with an uppercase letter, a lowercase letter, a number and a special character. The department's Change Password FAQs add a rule that catches people who cycle between two familiar passwords: the new password cannot be the same as any of your previous three.

One last piece of preparation. Confirm you are on the genuine portal before typing anything. Fake password-reset messages carrying a link to a lookalike site are a standard filing-season scam, and the portal's own Secure Access Message feature exists precisely so that a logged-in screen can be told apart from an imitation of one. Type the address yourself rather than following a link in an SMS.

This is the default route, and the e-Filing Vault FAQs confirm that where no higher security has been enabled, the password is reset using the default option of e-Filing OTP. The prerequisite is stated just as plainly in the reset manual: you must have access to the primary email address and the primary mobile number registered with your e-Filing account. Not one of them. Both.

The flow is short. Enter your user ID, choose the e-Filing OTP option, confirm your date of birth or date of incorporation, and the portal sends two separate six-digit codes — one to the registered mobile, one to the registered email. You enter both, then set the new password. The fifteen-minute validity and three-attempt limit apply to each.

The reason this route fails is almost never technical. It is that the contact details on the profile are stale. A PAN registered in 2016 carries the mobile number of 2016. If you changed operators without porting, or the number lapsed for non-use and was recycled, the SMS is being delivered somewhere else entirely. The email address has the same problem, with the added wrinkle that a workplace address dies when the job does.

Before assuming the number is dead, rule out the ordinary causes. Check the phone's spam or blocked-message folder, check that the email did not land in promotions or junk, and check that you entered the user ID correctly — for an individual the user ID is the PAN, and a mistyped PAN produces a reset attempt against somebody else's account or none at all.

If exactly one of the two codes arrives, the route is still closed. The portal requires both, and there is no partial completion. That is worth knowing early, because a great deal of time gets lost resending an SMS that is working perfectly while the email OTP sits undelivered at a defunct address.

There is a related trap for people who share a profile with a family member or an accountant. The e-Filing profile carries primary and secondary contact details, and updating a secondary address does nothing for a reset — the OTPs go to the primary mobile and primary email. If you have added yourself as a secondary contact and the primary is still the consultant, this route belongs to the consultant, not to you.

When e-Filing OTP is unavailable, do not keep retrying it. Every failed attempt at the login screen counts toward the lock threshold discussed later on this page, and a locked account on top of a lost password is a worse position than the one you started in. Move to the Aadhaar route.

This is the route that saves most people, because it does not care what contact details sit on the e-Filing profile. The code goes to the mobile number registered with your Aadhaar, which is a completely separate record held by the Unique Identification Authority of India. If you changed your phone number and told your bank and your Aadhaar but never told the tax portal — which is the ordinary pattern — this route is open and the previous one is not.

The prerequisite in the department's manual is that the PAN is linked with Aadhaar for individual taxpayers, and that the PAN of the principal contact is linked with Aadhaar for other categories of taxpayer, with companies and Hindu Undivided Families excluded. The login FAQs make the same point from the other direction: if the registered mobile number is not available, you may log in using Aadhaar OTP provided the PAN is linked with Aadhaar.

If the link is not in place, it can be made without logging in. The Link Aadhaar user manual describes both a pre-login route from Quick Links on the portal home page and a post-login route from the dashboard, and sets out that the linking fee must be paid first through e-Pay Tax as a single challan under minor head 500 within major head 0021 before the request is submitted. Linking itself sends an OTP, so the Aadhaar mobile still has to be live.

The consequences of not linking are worth knowing while you are in there. Linking is required under section 139AA of the income tax law, and the department's FAQ states that an unlinked PAN becomes inoperative, with refunds withheld, no interest paid on a withheld refund, and tax deducted or collected at higher rates, until the PAN is made operative again. A password reset does not fix an inoperative PAN and an inoperative PAN will not stop the reset — they are separate problems that often arrive together.

The hard case is the one where the Aadhaar mobile number is also gone. UIDAI does not permit a mobile number change online. Its guidance on the myAadhaar online update service says the portal can only be used for address and document updates, and states that where you have lost or no longer possess the mobile number registered with Aadhaar you must personally visit the nearest Aadhaar Seva Kendra to have the mobile number updated. That means a booked appointment, biometric authentication and a fee — and it means the tax deadline is not going to wait for it.

A name mismatch between the two records is the other common blocker. The department's Link Aadhaar FAQ tells you to correct the details in either the PAN database, through Protean or UTIITSL, or in the Aadhaar database through UIDAI, and notes that biometric authentication at an authorised service centre is available where the ordinary linking route will not go through. Both are slow. Neither is optional if the mismatch is real.

If your Aadhaar mobile is current, this is the fastest recovery available and it is worth trying before anything involving a bank. It is also the reason keeping the Aadhaar mobile number up to date is quietly one of the highest-value pieces of administrative hygiene available to an Indian taxpayer — it is the fallback identity for far more than the tax portal.

Bank account EVC is the next option. The prerequisite is a validated bank account on the portal and access to the mobile number or email registered with that bank. Note the distinction carefully — the reset FAQ says the electronic verification code is delivered to the mobile number registered with your pre-validated bank or demat account, not to the mobile number registered with the tax portal. For people whose bank has the new number and whose tax profile has the old one, that difference is the whole solution.

If the bank account EVC option is not showing on your reset screen, the department's FAQ gives the reason and the fix in the same sentence: the method has to be added through the e-Filing Vault Higher Security service. That is a post-login action, which is unhelpful when you are locked out, and it is the clearest illustration of why this setting deserves attention while you still have access.

Demat account EVC works identically, with the code going to the mobile or email registered with the depository rather than with a bank. Anyone who opened a demat account to buy a few shares has this route available and usually does not realise it. It is worth checking whether the account was ever pre-validated on the portal, because an unvalidated demat account does nothing for you here.

The Digital Signature Certificate route is the most restrictive. The reset FAQ requires an active certificate of Level 2 or above approved by a Certifying Authority, and the manual adds that the emsigner utility must be downloaded and running and the DSC USB token — Class 2 or Class 3 — connected to the machine. In practice this is a route for companies, firms in audit and professionals who already sign filings, not for a salaried individual. An expired certificate produces an invalid-DSC error and nothing else.

Net banking is the route most people overlook, and it is not strictly a reset at all. The manual describes it as e-Filing login using net banking: you pick your bank, authenticate inside your own net banking session, and arrive on the e-Filing dashboard, from which you use the Change Password service to set a new password. The prerequisites are that the PAN is linked with the bank account, that net banking is active, and that the facility has been enabled through the e-Filing Vault Higher Security service.

The login FAQs add a constraint worth planning around: only one validated bank account can be enabled for net banking login on a profile, and the facility is switched on from the profile by adding the bank account and enabling login through net banking. If you bank with two institutions, decide deliberately which one holds this privilege, and pick the account you are least likely to close.

Weighing these up honestly, most individual taxpayers have two realistic routes when the registered mobile is gone — Aadhaar OTP and net banking — and both depend on preparation done months earlier. That is the argument for spending ten minutes on your profile at a calm moment rather than at eleven at night in the last week of July.

The e-Filing Vault Higher Security service is described by the department as providing a second level of authentication when logging into the e-Filing account and second factor authentication for password reset. It is opt-in, it is set from My Profile on the dashboard, and login and password reset are configured separately — you can insist on a second factor for one and not the other.

Five methods can be nominated: net banking, a Digital Signature Certificate, OTP on the mobile registered with Aadhaar, bank account EVC and demat account EVC. The Vault FAQs confirm that more than one method can be opted for, but that you have to choose one of the opted methods at the moment of logging in. They also confirm the default position: where the Vault has not been enabled, the password is reset using the default e-Filing OTP option.

The failure mode is obvious once stated. Somebody enables higher security with demat EVC as the factor, closes the demat account three years later, and then finds that the reset screen no longer offers the friendly e-Filing OTP option because the profile has been told to demand something stronger. Nothing has gone wrong technically. The account is doing exactly what it was configured to do, to a person who no longer remembers configuring it.

There is a historical wrinkle that still catches people. The Vault FAQs note that higher-security preferences were not carried across when the department moved to the current e-Filing portal, and that users have to choose the higher security options again on the new portal. Anyone who set this up on the old site and assumes it is still in force may find the opposite is true, and anyone who reconfigured it after the migration may have picked a factor casually and forgotten.

The department's own manual says the Vault selections can be deselected independently for login and for password reset from the same screen. That is the escape hatch, but it only works from inside a logged-in session. If you are already locked out with a dead second factor, the Vault cannot be turned off and you are into the helpdesk and grievance routes further down this page.

So the practical instruction is a maintenance one. Every time you change a phone number, close a demat account, switch banks or let a DSC lapse, open My Profile and check what the Vault is pointing at. It takes a minute and it is the difference between a two-minute reset and a fortnight of correspondence.

If you are deciding whether to turn the Vault on at all, the honest answer is that it is genuinely useful protection for an account that holds your entire financial history — but only if the factor you choose is one you will still control after losing a phone. Aadhaar OTP and net banking meet that test. A token in a drawer and a dormant demat account do not.

This is the most common version of the problem and the least well documented. A chartered accountant or return-filing agent registered the PAN, used their own office mobile number and email address in the contact details so that the OTPs came to them, filed a return or two, and the relationship ended. The account still works. It simply answers to somebody else.

The portal cannot help you here by taking your word for it, and it should not. Every reset route is a proof-of-identity mechanism, and the contact details on the profile are one of those mechanisms. What you need is a route that proves identity against a record the consultant never controlled — which means Aadhaar OTP first, because the mobile registered with your Aadhaar is yours, and net banking second, because the bank account is yours.

Once you are back inside, the first action is not to file anything. It is to open My Profile and go to Contact Details, which the department's My Profile manual describes as the place to view and update your mobile number, email ID and address. Replace the primary mobile and primary email with details you control. The change is confirmed by OTP, which is why you have to be logged in to make it.

Then change the password even if you have just set one, so that any credential the former consultant retained stops working, and remember the constraint from the Change Password FAQs — the new password cannot repeat any of your previous three. The portal confirms the change with a transaction ID and messages to the registered mobile and email, which will now be yours.

While you are in My Profile, set a Secure Access Message. The manual describes it as a personalised message displayed every time you log in, and its purpose is to let you confirm you are on the genuine portal before you type a password. It is a small feature that does real work during filing season, when phishing messages impersonating the department are at their heaviest.

If none of the reset routes opens — no live Aadhaar mobile, no net banking, no EVC, no DSC — the fallback is written and human. The department's contact page lists the e-Filing and Centralized Processing Center helpdesk on 1800 103 0025 and 1800 419 0025, together with +91-80-46122000 and +91-80-61464700, working 08:00 to 20:00 Monday to Friday. The same page gives email addresses by subject, with [email protected] for general e-Filing issues and [email protected] for return-specific ones. Write from an address you control, quote the PAN, describe precisely which routes you tried and why each failed, and say what you want changed.

If that produces nothing, escalate through the portal's own grievance service, which can be submitted before logging in and covers e-Filing, Assessing Officer, CPC-TDS and CPC-ITR categories, with status trackable both pre-login and post-login. Beyond that sits CPGRAMS, the central public grievance portal, which is available around the clock and carries an appeal facility where a citizen who rates the resolution as poor can appeal. Note its own instruction that grievances sent by email are not entertained — the complaint has to go through the portal.

A locked account is a different problem from a forgotten password, and the two get conflated constantly. The login FAQs state that the account is locked after five unsuccessful attempts to enter the password, and that access is restored either through the Unlock your account facility or automatically after thirty minutes. If you have just failed five times, the correct action is to stop, wait out the half hour, and then attempt a reset properly rather than a sixth guess.

Forgotten user ID is usually not a real problem either. For individual taxpayers the user ID is the PAN, and the login FAQs say so directly. Aadhaar can be used as the user ID, but only where it has been linked with the PAN on the e-Filing portal — it is not an independent identifier. Anyone who has been hunting for a separate username has been hunting for something that does not exist.

For everyone else the user ID follows a published pattern. A chartered accountant uses ARCA followed by the six-digit membership number, an e-Return Intermediary uses ERIP followed by a six-digit number, and an external agency uses EXTA followed by a six-digit number. Tax deductors log in with their TAN. If you administer a company's account rather than your own, the reset flows run against the principal contact's PAN, and the Aadhaar prerequisite attaches to that person.

The third category is the PAN that was never registered. Registration and reset are different services, and attempting to reset a password for a PAN with no e-Filing account produces nothing useful. The registration manual sets out what is needed — a valid and active PAN, a valid mobile number and a valid email ID — and describes the verification as two separate six-digit OTPs, one to the mobile and one to the email, each valid for fifteen minutes with three attempts. If the PAN turns out to be already registered, the portal says so, and you are back to reset rather than registration.

Then there are the failures that have nothing to do with credentials. A password reset will not make an inoperative PAN operative, will not verify a return you filed and never e-verified, and will not release a refund that failed because the bank account was not pre-validated. Diagnose which of these you actually have before spending an evening on the login screen.

Browser behaviour accounts for a surprising share of apparent reset failures. The department's own advice, given in the Change Password material, is to delete temporary browser files and try again if the operation does not go through. The DSC route in particular depends on a local utility and a connected token, and will fail silently on a machine where the utility is not running.

Finally, treat an unexpected confirmation as a security event rather than a glitch. Because the portal sends a message to the registered mobile and email on every successful password change and reset, an alert you did not initiate means somebody else completed a reset against your PAN. Log in, change the password, check the contact details in My Profile, and raise a grievance with the transaction reference.

Do the profile work immediately, while the memory of being locked out is fresh. Open My Profile and confirm that the primary mobile number and primary email address in Contact Details are ones you personally control and expect to keep. This single field is the difference between a two-minute reset and a fortnight of escalation, and it is the field most likely to be years out of date.

Check that your PAN and Aadhaar are linked and that the mobile number registered with Aadhaar is current. Because UIDAI requires an in-person visit to a Seva Kendra to change the Aadhaar mobile, this is the item with the longest lead time in the whole exercise — you cannot fix it in an emergency, so fix it when there is no emergency.

Pre-validate a bank account if you have not already. It earns its keep twice over: it is how a refund reaches you, and it is what makes the bank account EVC reset route available. If you hold a demat account, check whether it is validated on the portal too, since that is a second independent EVC path at no extra effort.

Enable login through net banking on one bank account. The login FAQs are clear that only one validated bank account can carry this, so choose the bank you are least likely to leave. Of all the routes described on this page, this is the one that survives a lost phone, a changed number and an expired certificate at the same time.

Make a deliberate decision about the e-Filing Vault. If you turn higher security on, nominate a factor you would still hold after losing your handset — Aadhaar OTP or net banking — rather than a token or an account you rarely touch, and write down what you chose. If you would rather not manage a second factor at all, leave it off and the default e-Filing OTP route stays available.

Set the Secure Access Message, and take it seriously in July. Filing-season phishing works by sending an urgent password-reset link that lands on a convincing copy of the login page; a personalised message that the copy cannot know is a cheap and effective defence. Reaching the portal by typing the address yourself is a better habit still.

Keep the transaction IDs. Every successful reset and password change generates one, and the confirmations go to your registered contact details. Filed away, they answer questions about who had access when — which matters most in exactly the situation this page began with, where a former consultant and a taxpayer both once held the keys to the same account.