Guidance

SMS guide 13: Multi-factor authentification (MFA) (accessible)

Updated 1 September 2026

Additional SMS manuals

There are 12 SMS user manuals available, plus a supplementary policy guide for completing a CAS. The guides are grouped into three categories: common, CAS and CoS. The table below describes the purpose and audience of each manual.

You should read all manuals applicable to your licence before contacting the relevant helpdesk.

Manual reference	Manual title	Type	Purpose	Audience
Manual 1	Introduction to SMS & managing user access	Common	Use this manual to log into SMS, change your password, manage SMS users and view important messages posted by the Home Office. In addition, this manual explains who should use SMS and for what purpose. The manual features a full introduction to SMS as well as a comprehensive troubleshooting section.	All sponsors
Manual 2	Managing your licence	Common	To help sponsors manage their key personnel, change their licence details, manage PAYE references, and apply for allocations of CoS/CAS.	All sponsors
Manual 3	Apply for Basic Compliance Assessment and manage Action plans	Common	To help sponsors apply for Basic Compliance Assessment and manage action plans.	All sponsors
Manual 4	Creating and assigning CAS	CAS	To help sponsors create and assign individual and batches of CAS.	Sponsors licensed in the Student Route
Manual 4a	Creating a CAS – guide for education sponsors	CAS	This manual contains supplementary information on completing a CAS. Use this guide to determine what information is necessary in each field of the CAS.	Sponsors licensed in the Student Route
Manual 5	Reporting student activity	CAS	To help sponsors report student activity, for example if a student’s circumstances change. This manual also contains help with reporting fee updates and adding sponsor notes to CAS that have already been assigned.	# Sponsors licensed in the Student Route
Manual 6	Miscellaneous CAS functions	CAS	To help sponsors complete all other functions of CAS, such as managing batches of CAS, managing pre-stored addresses for use when creating CAS, transferring ownership of CAS, printing CAS and exporting CAS.	Sponsors licensed in the Student Route
Manual 7	Bulk Data Transfer of CAS	CAS	## To help sponsors use the bulk data transfer (BDT) functions of SMS, including graduate notifications. You must have a bespoke IT system in place to use BDT.	Sponsors licensed in the Student Route
Manual 8	Creating and assigning CoS	CoS	To help sponsors create and assign individual and batches of CoS.	Sponsors licensed in any Worker or Temporary
Manual 9	Reporting worker activity	CoS	To help sponsors report worker activity, for example if a worker’s circumstances change. This manual also contains help with adding sponsor notes to CoS that have already been assigned.	Sponsors licensed in any Worker or Temporary Worker route
Manual 10	Miscellaneous CoS functions	CoS	To help sponsors complete all other functions of CoS, such as managing batches of CoS, managing pre-stored addresses for use when creating CoS, transferring ownership of CoS, and printing CoS.	Sponsors licensed in any Worker or Temporary Worker route
Manual 11	Temporary Work – Creative Worker Group of CoS	# CoS	To help sponsors create and manage groups of CoS. Groups of CoS are only available to sponsors licensed in Temporary Work - Creative Worker	Sponsors licensed in Skilled Worker
Manual 12	Defined CoS	CoS	To help sponsors apply for defined CoS, track applications for defined CoS and once granted, create defined CoS.	Sponsors licensed in Skilled Worker
Manual 13	Multifactor Authentication	Common	To provide sponsor with an extra layer of security for your SMS account	## All Sponsors

Glossary

Term	Meaning
SMS	Sponsorship Management System
CoS	Certificate of Sponsorship
CAS	Confirmation of Acceptance for Studies
AO	Authorising Officer
KC	Key Contact
MFA	Multi Factor Authentication
OTP	One Time Passcode

Introduction

What is Multi-Factor Authentication?

Multi-Factor Authentication, also known as MFA, is an extra layer of security for your SMS account. It is designed to make sure you are the only person who can access your account.

How does MFA work?

If you are a Level 1 or Level 2 User, you will be asked for the following details when MFA is enabled on your SMS account:

• your SMS user ID and password
• your date of birth if you are a Level 1 user
• a one-time passcode (OTP) which will be sent to the mobile number or email address registered in your user details within your SMS account

The OTP is valid for 10 minutes and you will need to enter this into SMS in order to complete your log in journey and access your licence details.  

Why has MFA been introduced to SMS?

As cyber scams become more sophisticated, multi-factor authentication helps to keep cyber criminals out of your account. MFA significantly reduces the risk of unauthorised access of your SMS account, even if your password is compromised. It helps protect your personal and sponsorship-related information held in SMS.

Checking your licence and personal details

You should check the Licence summary section in the SMS (located in the Licence summary, applications and services menu item) regularly, to ensure your licence details are accurate. Detailed instructions on how to do this can be found can be found in the ‘SMS Guide 2: Manage your sponsorship licence’.

You should also check your personal details and those of your Level 2 users using the ‘Manage Level 1 and 2 users’ function under the ‘Licence summary, applications and services’ section of SMS. You will need to make sure the following details are up to date on your SMS account:

• your email addresses
• the mobile number used for MFA purposes if you are a Level 1 user
• your date of birth if you are a Level 1 user

Detailed instructions on how to do this can be found can be found in ‘SMS manual 1: Introduction and managing user access’.  If your details are incorrect, you must submit a request to change them. The SMS guides provide a step-by-step guide to how to do this.

Avoiding cyber scams and phishing attempts

You should always access your SMS account through the.gov.uk website. To do this:

• Search for ‘www.gov.uk’ on your internet browser
• Select the ‘Welcome to.Gov.UK’ link
• Search for ‘UK visa sponsorship management system’
• Select the ‘UK visa sponsorship management system’ link
• Select ‘Start Now’ from the page presented
• Begin logging into your SMS account

Please remember, when we contact you, we will never:

• Send you a link to the SMS log in page or SMS related guidance or send you attachments with an embedded link to the SMS log in page or SMS related guidance
• Send you a link to view messages or take other action on your SMS account
• Send you a link to view messages or take other action outside of your SMS account
• Ask you to provide any your SMS user ID, password, OTP or personal information such as your date of birth outside of the SMS system
• Send you an OTP when you have not requested one

When we contact you, we will always:

• Advise you to log into SMS by accessing www.gov.uk
• Advise you to check and update your personal details in your SMS account
• Advise you not to click on links to SMS or SMS related guidance sent to you by e-mail

If we receive information suggesting your account has been compromised, we will take steps to secure it, including deactivating users, and will contact you with next steps.

SMS manuals

Guide 1: How to log in using MFA with an OTP for the first time

Follow the step-by-step instructions below to log into SMS using Multi-Factor Authentication. Be scam aware. Never share your SMS user ID, password or one time passcode (OTP) with anyone else. Never change your password because someone else has asked you to.

This guide should be followed the first time you log into SMS using MFA.  

If you are a new user, you should read the Sponsorship policy guidance before logging into SMS for the first time to understand more about your role and the duties you are required to undertake.

Step

Instruction

1

From the SMS log in screen, enter your Level 1 or Level 2 user ID and your password. If you have as not received or forgotten your Level 1 User ID, then you should request this information from your Authorising Officer. The Level 1 User ID can be found in the Decision Letter. A Level 1 user on your licence can find your user ID from the Manage Level 1 and 2 users screen (located in the Licence summary, applications and services menu item) in SMS

One-time Passcode (OTP) via Mobile (Level 1 users only- Level 2 users should refer to the ‘One-time Passcode (OTP) via email’ section)

Step	Instruction
2	Enter your mobile number by first selecting the ‘Mobile’s country code’. Then add your mobile number and select ‘Next’. Please ensure your mobile number is correct. If you have already registered a mobile telephone number for MFA on SMS, you will be shown the last 4 digits. If the digits are incorrect, you can amend your mobile number.
3	Enter your ‘Date of Birth’ – this must match the DOB that is stored on the Level 1 user details on your sponsor licence. If you have already registered a mobile telephone number for MFA on SMS and you do not need to amend this, you will not be asked to enter your DOB.
Note	Please ensure all fields are completed before pressing next. You will have 3 attempts to enter your DOB correctly. If you enter your DOB incorrectly after 3 attempts your account will be locked out for 24 hours. Please see page 21 if you get locked out.
4	After you have entered your DOB correctly, you will be presented with a summary page showing the mobile number where the OTP will be sent via text message. You can still amend your mobile telephone number at this point. Select ‘Request OTP’.
5	You will receive a text message from ‘GOVUK’ with a 6-digit passcode
Note	Please wait up to 1 minute to receive the One time passcode (OTP).
6	Enter the ‘OTP’ into the screen on SMS and select ‘Submit’
Note	The OTP is valid for 10 minutes. If you do not enter and submit the OTP within 10 minutes, it will be invalid. Press ‘Request new OTP’ to receive a new code. MFA has been introduced to secure your account. Never give this code to anyone else. If you receive an OTP but are not attempting to log into the SMS or if someone contacts you for the code, do not provide the code to them, please report this to us here: BusinessHelpdesk@homeoffice.gov.uk

One-time Passcode (OTP) via email- Level 2 users and Level 1 users without a mobile telephone

Step	Instruction
1	Enter your Level 1 user ID and your password in the SMS log in screen.
2	From the MFA: Mobile Number Summary screen select ‘Amend’. The MFA: Enter Mobile Number screen will display.
3	Select ‘I don’t have a mobile number’ to switch to the email route.
4	The ‘Confirm Email Address’ page displays the email address associated with your SMS account. If this is correct, select ‘Request OTP’ to generate a passcode. If it is incorrect or you do not recognise the email address, select ‘Amend’ and follow the on-screen step to update it.
Note	The email address shown is the email address associated with the user’s SMS account. If this is incorrect L1 users can select ‘Amend’ and enter the correct email address. An automated email will be sent to both the original and the new email address linked to the L1 user account. If you receive a suspicious email or telephone call, or if you believe your SMS account has been compromised, please report this to us here: BusinessHelpdesk@homeoffice.gov.uk
5	‘Enter’ and ‘Confirm’ your email address. Select ‘Next’ and proceed to log on. Once you have logged in you should follow the steps on the screen to ensure your SMS account has not been compromised.
Note	Level 2 users cannot amend their email address. If your email is incorrect L1 users can select ‘Amend’ and enter the correct email address. An automated email will be sent to both the original and the new email address linked to the L2 user account. If you receive a suspicious email or telephone call, or if you believe your SMS account has been compromised, please report this to us here: BusinessHelpdesk@homeoffice.gov.uk
6	Confirm your email address. If it is correct, select ‘Request OTP’. This will generate an OTP to be sent to the email address displayed. If it is incorrect, select ‘Amend’ and follow the on-screen steps to update it.
Note	Please ensure all fields are correct before requesting the OTP
7	If ‘Request OTP’ has been selected this screen will display, advising that an OTP has been sent to your email address. Enter the ‘6-digit passcode’ into the screen on SMS and select ‘Submit’. If you have not received the OTP after one minute, select ‘Amend Email Address’ and follow the instructions to ensure the correct email address has been entered. If you have already done this, select ‘Request New OTP’.
Note	The OTP is valid for 10 minutes. If you do not enter and submit the OTP within 10 minutes, it will be invalid. Press ‘Request new OTP’ to receive a new code. MFA has been introduced to secure your account. Never give this code to anyone else. If you receive an OTP but are not attempting to log into the SMS or if someone contacts you for the code, do not provide the code to them, please report this to us here: BusinessHelpdesk@homeoffice.gov.uk
8	You will receive an email from ‘GOVUK’ with a 6-digit passcode OTP
Note	Please wait up to 1 minute to receive the OTP.
9	Enter the ‘6-digit passcode’ into the screen on SMS and select ‘Submit’
Note	The OTP is valid for 10 minutes. If you do not enter and submit the OTP within 10 minutes, it will be invalid. Press ‘Request new OTP’ to receive a new code. MFA has been introduced to secure your account. Never give this code to anyone else. If you receive an OTP but are not attempting to log into the SMS or if someone contacts you for the code, do not provide the code to them, please report this to us here: BusinessHelpdesk@homeoffice.gov.uk
10	Once you have entered the OTP you will be redirected to the SMS home screen where you can view your licence summary and undertake your sponsorship duties.
Note	Once MFA has been activated on your licence, an OTP will be required each time you log in to the SMS.

Guide 2: How to log in using a one-time passcode and amend your stored mobile number or email address

Follow the step-by-step instructions below to log into SMS using multi factor authentication. Be scam aware. Never share your SMS user ID, password or one time passcode (OTP) with anyone else. Never change your password because someone else has asked you to.

This guide should be followed if you need to amend your Mobile phone number or Email address held on SMS after you log in for the first time

How to Amend Your Mobile Number

Step	Instruction
1	To amend your Mobile Number (Level 1 users only) From the SMS log in screen, enter your Level 1 user ID and password.
2	You will be presented with a screen that shows the last 4 digits of your mobile number. The number displayed is the mobile number registered on your licence. If the last 4 digits of the mobile number displayed are incorrect, select ‘Amend’.
3	Choose the country code and enter the mobile number to which you want to receive the OTP and select ‘Next’
Note	It is important to double check the mobile number before pressing next.
4	Enter your ‘DOB’ – this must match the DOB that is stored on the level 1 user details on your sponsor licence.
Note	Please ensure all fields are completed before pressing next. You will have 3 attempts to enter your DOB correctly. If you enter your DOB incorrectly after 3 attempts your account will be locked out for 24 hours. Please see page 21 if you get locked out.
6	Select ‘Request OTP’ If you want to change the mobile number press ‘Amend’ and see ‘step 3’.
Note	Please ensure all fields are correct before pressing next. If the number is entered incorrectly, you will not receive the OTP.
7	You will receive a text message from GOV UK with a 6-digit passcode.
Note	Please wait up to 1 minute to receive the OTP.
8	Enter the passcode into the screen on SMS and press ‘Submit’
Note	The OTP is valid for 10 minutes. If you do not enter and submit the OTP within 10 minutes, it will be invalid. Press ‘Request new OTP’ to receive a new code. MFA has been introduced to secure your account. Never give this code to anyone else. If you receive an OTP but are not attempting to log into the SMS or if someone contacts you for the code, do not provide the code to them, please report this to us here: BusinessHelpdesk@homeoffice.gov.uk
9	Once you have entered the OTP you will redirected to the SMS home screen where you can view your licence summary and undertake your sponsorship duties. An automated email will be sent to you, notifying you when your mobile number has been changed.
Note	An automated email will be sent to the e-mail address we hold for you on SMS, notifying you when your mobile number has been changed. Never give this code to anyone else. If you receive an OTP but are not attempting to log into the SMS or if someone contacts you for the code, do not provide the code to them, please report this to us here: BusinessHelpdesk@homeoffice.gov.uk

How to Amend Your Email Address

Step	Instruction
1	To amend your Email address From the SMS log in screen, enter your Level 1 user ID and password.
Note	Level 2 users cannot amend their email address. If your email is incorrect L1 users can select ‘Amend’ and enter the correct email address. An automated email will be sent to both the original and the new email address linked to the L2 user account. If you receive a suspicious email or telephone call, or if you believe your SMS account has been compromised, please report this to us here: BusinessHelpdesk@homeoffice.gov.uk
2	You will be presented with the Confirm Email Address screen. The email address displayed is the address associated with your SMS account. If the email address displayed is incorrect, select ‘Amend.’
3	‘Enter’ your email address below, select ‘Next’ and proceed to log in. An error message will display if the format of the email address entered is invalid, or if the email addresses entered in both fields do not match.
4	Enter your ‘Date of Birth’ – this must match the DOB that is stored on the Level 1 user details on your sponsor licence.
Note	Please ensure all fields are completed before pressing next. You will have 3 attempts to enter your DOB correctly. If you enter your DOB incorrectly your account will be locked out for 24 hours. Please see page 21 if you get locked out.
5	Confirm your email address. If it is correct, select ‘Request OTP’. This will generate an OTP for the MFA journey.
Note	Please wait up to 1 minute to receive the OTP. You should note that if you also have a mobile telephone number registered for MFA on SMS, you will be asked to re-enter this number the next time you select to receive the OTP by mobile phone.
8	Enter the passcode into the screen on SMS and press ‘Submit.’ If you have not received the OTP after one minute, select ‘Amend Email Address’ and follow the instructions to ensure the correct email address has been entered.
Note	The OTP is valid for 10 minutes. If you do not enter and submit the OTP within 10 minutes, it will be invalid. Press ‘Request new OTP’ to receive a new code. MFA has been introduced to secure your account. Never give this code to anyone else. If you receive an OTP but are not attempting to log into the SMS or if someone contacts you for the code, do not provide the code to them, please report this to us here: BusinessHelpdesk@homeoffice.gov.uk
9	Once you have entered the OTP you will redirected to the SMS home screen where you can view your licence summary and undertake your sponsorship duties.
Note	An automated email will be sent to you, notifying you when your email address has been changed.

Guide 3: How to amend an invalid Date of Birth or if the Date of Birth entered does not match our records

Follow the step-by-step instructions below to log into SMS using multi factor authentication. Be scam aware. Never share your SMS user ID, password or one time passcode (OTP) with anyone else. Never change your password because someone else has asked you to.

This guide should be followed if you have entered an invalid Date of Birth or if it does not match our records.

Step	Instruction
1	Following the SMS log in page, enter your mobile number by first selecting the mobile’s country code. Then fill in the ‘Mobile number’ and select ‘Next’. Please ensure your number is correct
2	Enter your ‘DOB’ – this must match the DOB that is stored on the Level 1 user details on your sponsor licence.
Note	Please ensure all fields are completed before pressing next.
3	If an invalid DOB has been entered an error message will display requesting a valid date of birth to be entered. Enter a valid DOB and select ‘Next’.
4	If you have entered a valid DOB and it does not match our records an error message will display. Please try again and select ‘Next’.
Note	You will have 3 attempts to enter your DOB correctly.
5	After 3 DOB input failures, your account is locked for 24 hours. Please try again after 24 hours. If you have reattempted to log in, but the DOB is still incorrect please complete the MFA manual change of circumstances form. Sponsor change of circumstances form - GOV.UK
Note	If you enter your DOB incorrectly or if the DOB does not match the DOB stored on the sponsor licence, your account will be locked out for 24 hours. Please try again after 24 hours. If you have reattempted to log in, but the DOB is still incorrect you must complete the MFA manual change of circumstances form to update it.

Guide 4: How to request another one-time passcode (OTP)

Follow the step-by-step instructions below to log into SMS using multi factor authentication. Be scam aware. Never share your SMS user ID, password or one time passcode (OTP) with anyone else. Never change your password because someone else has asked you to.

This guide should be followed if you have entered an invalid OTP or want to request another OTP.

Step	Instruction
1	From the SMS log in page, follow the earlier steps of entering or confirming your mobile number or email address and select ‘Request OTP’. On the ‘Enter OTP screen’ displayed, input the ‘Passcode’ received via text message or email to your mobile number and select ‘Submit’.
Note	The OTP is valid for 10 minutes. After this time, it will expire, and you should request a new OTP. Please allow up to one minute for the OTP to arrive. If you have not received the OTP after one minute, please select ‘Amend Mobile/Email Number’ and follow the instructions to ensure the correct mobile number or email address has been entered. If you have already done this, please select ‘Request New OTP’. The Request New OTP button will only become available after one minute. Please do not refresh this page, as this will reset the timer. You can only select ‘Request New OTP’ twice, please ensure that your mobile number is correct.
2	If an invalid OTP is entered, an error message is displayed. Please re-enter the correct OTP code and select ‘Submit’.
Note	The OTP is valid for 10 minutes. You have 3 attempts to input a valid OTP.
3	If an OTP has been incorrectly entered 3 times an error message will display stating that the retry limit has been reached. A new OTP should be requested.
4	You can only select ‘Request New OTP’ twice. If you exceed the limit for OTP requests or incorrect attempts, your account will be locked out for 20 minutes. You can attempt to log in again after this time.
Note	When attempting to log in please take the following steps: - Select amend your mobile number or email address - Enter your mobile number or email address to ensure the OTP is being sent to the correct location - Wait up to one minute before requesting a new OTP

Guide 5: Troubleshooting

Issue / Error message	Cause	Resolution
Date Of Birth (DOB) is not recognised. DOB entered incorrectly 3 times and now locked out for 24 hours	- The DOB you are trying to enter does not match the DOB that is held on your licence.	Contact us using the Change of Circumstances form found here: Sponsor change of circumstances form - GOV.UK
OTP is not arriving	- Your mobile number was entered incorrectly - You have added the correct mobile number, and the Country code was wrong. - Your email address was entered incorrectly	Amend mobile number or email address and request new OTP
Level 2 user wants to amend their email address	- Level 2 users cannot amend their email address.	Please contact a Level 1 user on your licence to make the amendments and try again.

Guide 6: Frequently Asked Questions (FAQs)

1. Will MFA and an OTP be required every time I log into SMS?
Yes, MFA has been introduced to protect your account. Once enabled on your licence, an OTP will be required every time you and other users listed on your licence log into SMS. 

2. Is MFA mandatory?
 Yes. MFA will be rolled out to all sponsors in the coming months and will be a mandatory security feature for all SMS users.

3. How will I know when my SMS account has been enabled for MFA?

We will e-mail your Authorising Officer, Key Contact, Level 1 and Level 2 users two weeks before your account is enabled to tell you the date that you will start using the new functionality.

4. Will MFA affect how I use the SMS?
No, MFA only affects the login process. You will continue to sign in using your existing user ID and password and then enter a one-time passcode (OTP). Nothing else is changing and once authenticated, you will use the system as usual.

5. My email address/phone number/date of birth is incorrect on SMS, what should I do?

You should check and update these details before MFA is enabled on your licence. If you have not updated your email address or phone number before MFA is enabled on your licence, Level 1 users can change them via the MFA process; however, you will need to enter your date of birth when you do this.

If you are a Level 2 user, you will need to ask a Level 1 user to make these changes before you can log into your SMS account.

6. What happens if I do not correct my date of birth on SMS before MFA is enabled?

If your date of birth is incorrect on your SMS account, you will need to inform us using the Sponsor Change of Circumstances form so that you can log in using MFA. This form can be found by searching for ‘Sponsor change of circumstances form’ on the.gov.uk website:

Sponsor change of circumstances form - GOV.UK

To complete the form for date of birth changes only:

• In Section A select the option to ‘Appoint a new Level 1 User’
• Complete Section B with your licence details.
• In Section C provide your first name(s), last name, e-mail address and date of birth.
• Complete Section G
• Send the completed form as an attachment by e-mail MFACOC@homeoffice.gov.uk using the subject header ‘DOB change request’

You and your Level 1 Users must check the date of birth recorded for you on SMS as soon as possible and before MFA is enabled. If this information is incorrect when MFA is introduced, you may be unable to complete successfully and could experience delays.

7. What should I do if I do not know my SMS user ID?

If you cannot remember your user ID and are the only Level 1 user with access to SMS, you should check the letter sent to your AO when your sponsor licence was granted.

If you are unable to locate the letter, you can contact the Business Helpdesk on BusinessHelpdesk@homeoffice.gov.uk who will be able to provide the user ID to you. Please note, the helpdesks will only be able to disclose licence details if the original email came from an address registered with an active member of key personnel on the licence.

Once they have confirmed your identity, the helpdesk will email your user ID to your AO to forward on to you. If you have more than one Level 1 user on SMS, you should ask a different Level 1 user to obtain your user ID from the Manage Level 1 and 2 users screen (located at Licence summary, applications and services/Manage your Level 1 and 2 users).

8. How can I receive an OTP if my mobile phone is lost or stolen?

You can receive your OTP by email. This enables you to securely access your account. You must remove the lost or stolen mobile number from your SMS account as soon as possible

9. What if I can’t get an OTP while I am overseas?

If you are travelling abroad and are unable to receive an OTP via text message, you can use the email option. This ensures you can still access your account securely.

10. Why do you use text message or email instead of messaging apps (e.g. WhatsApp)?

We use text message and email because they are widely supported, secure and reliable methods for delivering authentication codes. Messaging apps like WhatsApp depend on internet access, app availability and service compatibility, which can vary across regions.

11. Who can I contact for help?
If you have any questions relating to MFA or require assistance, please contact:

 BusinessHelpdesk@homeoffice.gov.uk

Please provide your organisation name and sponsor licence number in the subject heading of your e-mail.

If you experience issues receiving a one-time passcode (OTP) once MFA is enabled on your account, please provide the following information in your email to us:

• A detailed Description of Issue
• Your mobile service provider name
• Mobile number
• Date OTP requested
• Time OTP requested