CRA Account Locked? How to Regain Access

First, identify where sign-in stopped

“Locked out” can describe several different problems. You might know your user ID and password but be unable to receive a one-time passcode. You might receive a passcode and enter it incorrectly too many times. Or the account might be locked after repeated wrong answers or failed document verification. Those situations do not have one universal reset button.

Read the wording on the CRA screen before trying again. CRA’s locked-account page names wrong entries for a CRA user ID or password, MFA passcode, security questions, CRA security code and document verification as possible reasons for a lock. It does not publish a single number of wrong attempts that applies to all of them. Repeated guessing is unlikely to help and can make it harder to see which problem you actually have.

If it is a temporary MFA lockout

MFA is the second sign-in check that asks for a one-time passcode. CRA says that entering the wrong one-time passcode too many times causes a temporary 30-minute lockout. After that period, you can try again or use another MFA method you previously enrolled. CRA does not say that one wrong code triggers the 30-minute wait.

The distinction matters: CRA says that if the temporary lockout happens three times, the account becomes permanently locked and you need to contact CRA. That means three separate lockouts, not simply three individual wrong passcodes. If the screen says you are permanently locked, waiting another 30 minutes is not the recovery route CRA gives.

Before entering a new code, check which method the sign-in screen expects. An authenticator app generates changing codes; a passcode grid uses the row-and-column combinations CRA asks for; a phone option can send a text or automated call. Use an alternative only if it was already enrolled for your account. CRA’s MFA help page explains each option.

If the passcode never arrives

Not receiving a code is different from entering a wrong code repeatedly. If you use a phone option, CRA says you can ask for the code to be resent or sent to another number already enrolled. If you use a VoIP phone service, its “Call me” option may work when text does not. If you enrolled a passcode grid or authenticator app, you can try that method instead.

If your number changed and you have no other enrolled method, CRA says to contact it. Do not create an unofficial workaround by sharing your password or one-time code with someone who offers to “unlock” the account. CRA says it will never call and ask for your one-time passcode. If you call CRA yourself, its MFA page explains a separate identity-verification process during that call.

If the account itself is locked

CRA’s general locked-account page gives two options: go through its registration process again, or use its contact information to request an unlock. Read the registration page’s limitation before choosing. It says you may be able to register again if you forgot a credential or security answers, your online banking information changed, or a credential was revoked, provided you can use an existing MFA option and complete identity verification. It also says you cannot use registration to regain access if CRA locked the account for security or other reasons. In that case, contact CRA.

For the specific case of a permanent lock after three temporary MFA lockouts, CRA’s MFA instructions explicitly say you must contact it. Do not keep cycling through codes in that situation. If you are unsure what kind of lock you have, tell CRA what the screen says and at which step you stopped. That is more useful than guessing that your tax return, benefits or bank account caused the sign-in error.

Use the official CRA sign-in page and its linked help. CanadianMoneyHelp.ca cannot see, unlock or reset a CRA account, and it will never ask for your password or one-time code.

After you regain access

CRA encourages more than one MFA option so a changed phone number, lost grid or deleted app does not leave you without an alternative. Only one option is currently mandatory, but you can add a backup once signed in. CRA’s directions are: from the Welcome page, select Security settings, choose Multi-factor authentication, then choose the option you want to add or change.

If you use a passcode grid, store it privately. If you use an authenticator app, use a reputable app from an official app store. Do not send a screenshot of a passcode or grid to a person offering help through a search result, text message or social post. The account-recovery path belongs on CRA’s site or with CRA itself.

A quick way to choose the next step

• Screen says temporary MFA lockout: Wait 30 minutes. Then try again carefully, or use another MFA method you already enrolled.
• You cannot receive the code: Try CRA’s resend, another enrolled phone number, “Call me” where relevant, or an enrolled grid or app. If none works, contact CRA.
• Screen says permanently locked after repeated MFA lockouts: Contact CRA; another wait is not the stated fix.
• You forgot a credential or security answer: Check whether CRA’s registration-again route applies. You need access to an existing MFA option. If CRA locked the account for security or other reasons, contact CRA instead.

These are routes from CRA’s current help pages, not a diagnosis of your particular account. Follow any more specific instruction shown on your CRA screen.

Related guides

If you regained access to check a return and are waiting for the money, see our tax-refund delay guide. A refund delay is a different problem from a sign-in lock, so check the return status separately once you can access your account.

Rules and process basis

This guide follows CRA’s locked-account and MFA help pages as checked on September 26, 2026. CRA controls account access and may change its sign-in screens or verification options. The temporary and permanent MFA rules above apply to wrong one-time passcodes; they should not be extended to other lock causes without CRA confirmation.