Is It Safe to Share GST Login and OTP? Read This Before You Do

Sharing your GST login and OTP is not safe as a habit. The password lets someone see and prepare everything on your GST account. The OTP is your signature: with it, a return, a refund claim or a change to your registration is filed in your name, and you remain answerable for it.

What can someone do with only your username and password?

Quite a lot of looking, and a fair amount of preparing. Once logged in, a person can see your returns, ledgers and notices, enter or upload sales data, and start an application to amend your registration or claim a refund.

The portal does put one check here. Its login manual describes a second step after the password, where an OTP goes to your registered mobile and email. It is not asked every time on a browser the portal already trusts. It is asked on the first login, on a new device, after too many login attempts in a minute, and when a login comes from a far-off place within a short time. So when your accountant calls and says "an OTP has come, please tell me", that OTP may be for nothing more than logging in. It may also be for filing. You cannot tell unless you read the message.

What changes when you share the OTP as well?

The OTP is the Electronic Verification Code (EVC), the portal's way of taking your signature without a digital signature certificate. The portal's own help pages confirm it is used for these actions:

• Filing returns. GSTR-1 is filed with a digital signature or EVC. The GSTR-1 help page says a filed GSTR-1 cannot be edited. Corrections go through GSTR-1A or a later return.
• Applying for a refund. A refund application in Form GST RFD-01, for example for extra balance in your electronic cash ledger, is filed with a digital signature or EVC.
• Changing your registration. Bank accounts and authorised signatories are added, edited or deleted through a non-core amendment. The portal says non-core amendments do not need a tax officer's approval. The application is signed with an OTP.
• Changing contact details. When the mobile number or email of a signatory is updated, the portal sends an OTP to the new number and email. After that, future OTPs go there.
• Opening the account to software. Under My Profile, "Manage API Access" can be switched on for 6 hours to 30 days. During that time the connected software is not asked for an OTP each time it connects.

A worked example

Riya sells kurtis on two marketplaces. Her accountant's office has her password, and she reads out OTPs on the phone. In one month her taxable sales were Rs 6,20,000. A junior in the office uploads only one marketplace report, so the GSTR-1 shows Rs 4,20,000. Riya reads out the OTP and the return is filed.

Sales of Rs 2,00,000 are now missing. If her goods are taxed at 5%, that is Rs 10,000 of tax not reported, and interest can follow when it is paid late. The filed GSTR-1 cannot be opened and edited. She has to add the missing sales through GSTR-1A or a later return. Nobody acted in bad faith, yet the return carries her name.

Now take the worse case. Her electronic cash ledger holds Rs 18,400 of TCS credit. As we understand it, a GST refund is paid into a bank account listed on the registration, and a new bank account can be added through a non-core amendment signed with an OTP. Two OTPs read out without a question could be enough to move that money somewhere else.

What does the GST portal offer instead?

1. Engage a GST Practitioner. If your accountant is enrolled as a GST Practitioner, go to Services, then User Services, then "Engage / Disengage GST Practitioner (GSTP)". You search for them, click Engage and sign an authorisation form with your OTP. They work from their own login. You can have one practitioner at a time. When you disengage, the portal says the practitioner can no longer do any activity on your behalf or open your dashboard.
2. Add an authorised signatory. A partner or trusted employee can be added through a non-core amendment with their own mobile and email, and removed the same way later.
3. Change your password. The "Change Password" link is at the top right after login. The portal makes you change it after 120 days in any case, and will not accept your last five passwords.
4. Check Manage API Access. If you once connected a software and no longer use it, choose No and confirm.

What habits keep you safe?

• Read every OTP message before you repeat it. If you did not ask for anything, do not share it.
• Ask to see the return summary before it is filed. Match the sales figure with your own marketplace reports.
• Change the password when an employee or accountant stops working with you.
• Look at your bank accounts and signatories on the portal once a quarter.
• Keep the registered mobile number active. If you change your number, update it before the old SIM is gone.

The mistake most sellers make

The usual mistake happens on day one. The person who applied for your GST registration typed their own mobile number and email as the primary authorised signatory. Every OTP since then has gone to them. You cannot file, reset the password or even know what was filed without calling them.

Fix this while you are on good terms. The mobile and email of the primary authorised signatory can be updated through a non-core amendment, and the OTP then goes to the new mobile and email. If the earlier signatory has died or cannot be traced, the portal's help page says you approach your jurisdictional tax officer with documents, and the officer resets the email and mobile.

Frequently asked questions

Read next