Your accountant or bookkeeper may need information from HMRC. They may also need permission to deal with HMRC on your behalf.
What they should never need is your Government Gateway user ID, password or security code.
HMRC is very clear about this: you must not share your sign-in details with anyone – including a tax agent. They should be treated with the same care as your online banking details.
“But they’re dealing with my tax for me…”
That’s perfectly normal. Sharing your login details isn’t.
Accountants and tax advisers have their own HMRC agent accounts. Where they need access, you formally authorise them to act for you. Depending on the tax or service involved, this might be through an online authorisation link, your business tax account or another HMRC process.
They then sign in using their own agent credentials, not yours!
This creates a proper record of who is acting for you and allows you to change or remove their authority without handing over access to your entire account.
Why does it matter?
Your HMRC account contains sensitive personal and financial information. Someone signing in as you may be able to:
- view or change your details
- submit information in your name
- make or redirect repayment claims
- access services they haven’t been authorised to handle
A security code doesn’t make sharing your login safe. That code is part of your sign-in security too, so don’t read it out or forward it to somebody who is trying to access your account.
Even when the person asking is genuine, trusted and only trying to help, using your personal credentials is not the correct way for a professional to act on your behalf.
What if someone asks for them?
You can simply say:
I don’t share my Government Gateway sign-in details, but I’m happy to complete the appropriate HMRC agent-authorisation process.
A legitimate professional should understand and guide you through the correct route.
If somebody insists that they need your password or asks you to send them the security code while they sign in as you, stop and question it.
Already shared them?
Don’t panic, but do take action.
Change your password, check that your security and contact details are correct, and review your account for anything you don’t recognise. If you notice suspicious activity, report it to HMRC.
And remember: providing information to your accountant is normal. Giving them the keys to your personal HMRC account isn’t.
HMRC provides further guidance on keeping your HMRC sign-in details safe and authorising an agent properly.
