Account Creation Limitations
Creating Accounts for Others
It is against Login.gov’s Rules of Use for an individual to create a Login.gov account on behalf of someone else. Contact the Login.gov team for questions about specific cases.
Personal vs. Professional Use
Login.gov provides users with one account for government. Users can associate multiple email addresses with their account and modify them at any time.
Authentication Limitations
Email as MFA
Login.gov does not support email as an MFA method. Per NIST 800-63 guidelines, email is not secure for multi-factor authentication because a compromised email account would allow an attacker to both reset the password and receive the second factor.
Available MFA options that do not require a phone include authentication applications, PIV/CAC cards, security keys, face or touch unlock, and backup codes. See Authentication Methods.
Push Notification MFA
Login.gov does not support push notification-based MFA methods. Per NIST guidance, push notifications are vulnerable to phishing attacks.
VOIP Phone Numbers
Login.gov does not currently support voice-over-IP (VOIP) phone numbers for SMS or voice MFA.
International Users Without SMS Access
Users in countries where Login.gov does not support SMS can still create and use a Login.gov account. SMS is not required. These users can use any non-phone MFA method: face or touch unlock, authentication applications , security keys, PIV/CAC cards, or backup codes. See the full list of Authentication Methods and the international phone support list.
International SMS and Voice
One-time codes can be sent via text and voice to U.S.-based phone numbers. For international numbers:
- SMS availability varies by country — see the international phone support list
- Voice messages are not available for numbers outside the United States
- One-time codes are valid for 10 minutes
Phone Number Limits
There is no limit on the number of Login.gov accounts a phone number can be associated with. However, rate-limiting protections exist to prevent a single phone number from requesting excessive text messages or calls in a short timeframe