Locked out of the IRD taxpayer portal: recovering your username and password

"I cannot log into IRD" describes at least three separate problems, and only one of them is genuinely self-service. The first is a forgotten password where the mobile number and email address registered against your PAN are still yours and still working. The second is a forgotten user ID — the portal's username, which is not your PAN and not your email. The third, and by far the most common in practice, is that the registered mobile or email on file belongs to somebody else entirely: a former accountant, a consultancy, an old employer, or a SIM you stopped paying for years ago.

The distinction matters because the portal's recovery flow leans on an OTP sent to the registered mobile number. If you hold that SIM, the whole thing resolves at your desk. If you do not, no amount of clicking will help, because the department has correctly designed the flow so that possession of the registered phone is the proof of identity. Recognising which case you are in takes about a minute and saves an afternoon.

It also helps to separate the PAN itself from the credentials. Your Permanent Account Number is not a secret and is not lost — it is printed on your PAN certificate, appears on salary paperwork and tax clearance documents, and can be checked against the Inland Revenue Department's own PAN search tool at ird.gov.np/pan-search, which takes a PAN and returns the registration held against it. Losing your password does not put your PAN at risk; the two live in different places.

A quick diagnostic: open the portal, expand the General menu and start the reset. The portal will show you your taxpayer name, your username and a partially masked version of the email address and phone number it holds. Read that screen carefully rather than rushing past it. If the masked mobile ends in digits you recognise, you are in case one and you will be finished shortly. If it does not, stop — you are in case three, and everything after this point is an office visit, not a browser task.

Be honest about the second case too. The portal's user ID is a value that was typed in when the PAN was registered, often by an agent at a cyber café or a consultancy that handled the registration. Many people have never seen it. It is not recoverable by guessing, and it is not your email address. The reset screen displays it back to you once you enter your PAN, which is the one genuinely convenient thing about the flow — but it displays it only after the portal accepts the PAN you typed.

One more thing worth fixing in your head before you begin. The body that owns this problem is the Inland Revenue Department, which sits within Nepal's revenue administration under the Ministry of Finance. Not your bank, not the Nagarik App, not the Office of the Company Registrar. Every route out of this — self-service, counter visit, escalation — runs through IRD's own portal, its head office in Lazimpat, or one of its field offices.

Start from the right address. The Inland Revenue Department's homepage at ird.gov.np carries a Taxpayer Portal link that lands on taxpayerportal.ird.gov.np/taxpayer/app.html. Reaching the portal by clicking through from ird.gov.np is a good habit, because it means you never have to trust a search result. Sponsored links and look-alike domains cluster around tax deadlines, and a page that looks like the portal but is not will happily collect your PAN and password.

The portal is a single-page application with a menu on the left called Integrated Tax System, grouped into headings — General, Registration (PAN, VAT, Excise), VAT, Estimated Return, Income Tax, Excise and Electronic-Tax Deducted at Source, among others. These headings are collapsed by default. The step almost everybody misses is that you must click the small plus sign beside General to expand it; the login and password options are children of that heading, not top-level items. Third-party walkthroughs of the portal, including the Yarsa Labs and eStartup Nepal guides, describe exactly this menu structure, and it is the reason the recovery flow is invisible to first-time users.

With General expanded you will see Taxpayer Login alongside the credential-recovery entry. Taxpayer Login is where you go once you have working credentials — it asks for three values, not two: your PAN, your user ID and your password. The recovery entry is the one you want now. Open it and enter your PAN.

The portal then returns a confirmation panel showing your taxpayer name, your username, and your registered email address and mobile number in partially masked form. According to the eStartup Nepal walkthrough of this flow, the full email and phone number are deliberately not revealed. Check the name is yours. Check the masked mobile ends in digits you recognise. Only then continue.

You will be asked to type a new password and confirm it, and the portal sends a one-time password to the registered mobile number. Enter the OTP to complete the reset, then return to Taxpayer Login and sign in with PAN, user ID and the new password. Log in immediately rather than a week later — if something has gone wrong, you want to find out now, not on the evening a return is due.

Record the credentials somewhere durable and private. A password manager is ideal; a note in your phone that says "IRD" is not. What you should avoid, specifically, is the arrangement that created this problem in the first place — the only copy of the password living in an accountant's notebook. If somebody else files on your behalf, they can hold the credentials, but you should hold them too, and the registered mobile and email should be yours.

If the portal will not load or times out mid-reset, the likeliest explanation is load rather than a fault at your end. Traffic concentrates brutally in the final days before a filing deadline. Try early morning, try again on a different network, and if you are anywhere near a deadline treat a slow portal as a reason to start earlier next year rather than a reason to give up tonight. The department's own IT support numbers, published on ird.gov.np, are the right escalation for a portal that is genuinely broken rather than merely busy.

The masking is not an oversight and it is not the portal being unhelpful for its own sake. A PAN is a semi-public number. It is printed on invoices, quoted on contracts, checked by banks, and searchable through the department's own PAN search tool. If entering a PAN returned a full email address and a full mobile number, anyone who could read a bill could harvest the contact details of the business that issued it. Masking is the correct trade-off, and it is the reason the recovery flow proves identity by sending an OTP rather than by displaying one.

What the mask still gives you is a recognition test, and that is exactly how you should use it. You are not being asked to reconstruct the address; you are being asked whether you recognise it. A masked mobile that ends in the last two digits of the SIM in your pocket is your number. A masked email whose visible fragment shows a consultancy's domain, or an employer's, is a strong signal that somebody else controls your recovery route.

Take a screenshot of that screen. It is the single most useful piece of evidence you can carry into an Inland Revenue Office or Taxpayer Service Office, because it shows an officer precisely what the system holds without you having to describe it. It also protects you if the record later changes: you have a dated record of what the portal displayed on the day you looked.

Do not attempt to work around the mask. There is no legitimate technique for revealing the full address, and pages or people offering one are running a different business from the one they advertise. Repeatedly submitting the reset in the hope of a different outcome does nothing except send OTPs to a stranger's handset, which is both futile and a small courtesy problem for whoever now holds that number.

It is also worth understanding what the mask does not tell you. It does not tell you whether the email account still exists, whether anyone still reads it, or whether the mobile number is still allocated to the person who registered it. A number can look right on screen and be dead in reality — disconnected, or reissued by the operator to someone new. The only reliable test is whether the OTP arrives on a device you are holding.

Finally, the mask is read-only. Nothing on that screen lets you change the email or phone number on file, and no amount of persistence will make it. Changing a registered contact is a records change to the PAN registration itself, and the department handles records changes through its offices, not through the self-service portal. That is the wall most people hit, and the next two sections are about getting over it.

There are four patterns behind almost every case of this, and identifying yours shapes what you take to the office. The first and most common is the former accountant or consultancy. When a firm registers a PAN on a client's behalf, it frequently uses its own mobile number and its own email address, because that is what is in front of the person filling the form. Years later the relationship has ended, sometimes badly, and the client discovers that the recovery route to their own tax account runs through an office they no longer deal with.

The second is the old employer. Salaried staff often receive a personal PAN opened by an HR or accounts department as part of onboarding, using a company email address and sometimes a company SIM. Both stop being yours the day you resign. The PAN, however, follows you for life — you do not get a new one at a new job — so the mismatch persists across every subsequent employer until you fix it.

The third is the agent or cyber café. A registration completed at a shop on a walk-in basis may have used an email address created on the spot, with a password nobody wrote down, on an account that has since gone dormant. There is no adversary in this case, just an abandoned mailbox. It is no more recoverable for being nobody's fault.

The fourth is the recycled number. Mobile numbers in Nepal are a regulated, finite resource — the Nepal Telecommunications Authority licenses operators and oversees numbering and SIM distribution as part of its regulatory remit — and a number that goes unused long enough can be reallocated. If the SIM you registered in 2019 lapsed, the OTP may now be arriving on a stranger's phone. The NTA runs a grievance system for telecom complaints, but it is the wrong door for this: no telecom regulator can alter what the Inland Revenue Department holds against your PAN.

In every one of those cases, resist the shortcut. The obvious move is to ring the former accountant and ask them to log in and file, or to read you the OTP. It is understandable and it is a mistake. The account is your filing identity, the return submitted under it is your return, and section 96 of the Income Tax Act 2058 places the duty to submit on the person, not on their agent. If a return goes in wrong, the exposure is yours. Ask for the credentials by all means, and take the handover if it is offered cleanly — but the fix is still to move the registered contact to something you control.

Equally, do not pay a stranger to solve it. Around every filing season, offers appear on Facebook groups and marketplace pages promising to recover an IRD login for a fee. There is no back channel. The department verifies identity at its counters or through an OTP to a registered number, and nothing else. Anyone claiming otherwise is either about to take your money, or about to take your PAN and citizenship details as well.

Self-service ends where identity has to be re-established from scratch, and at that point the Inland Revenue Department's field network takes over. Your PAN is administered by a specific office — an Inland Revenue Office or a Taxpayer Service Office — chosen at the time of registration. That office holds the registration record, and it is the body that can amend the mobile number and email address attached to it. Turning up at whichever tax office is nearest may work for advice, but the record change belongs to the office your PAN sits with.

If you do not know which office that is, several things will tell you: the PAN certificate itself names the issuing office, the acknowledgement from any previous return names it, and the department's PAN search at ird.gov.np/pan-search will confirm the registration held against your number. Any accountant who has filed for you will know it immediately. Establish this before you travel.

Take original documents, not photocopies alone. For an individual PAN, the working set is your citizenship certificate in original with a photocopy, your PAN certificate or card, a written application addressed to the office stating your PAN, the contact details currently on file as far as you know them, the new mobile number and email address you want registered, and your signature. Carry the phone with the new SIM active and in your hand — an officer may want to see an OTP arrive before finalising the change. A screenshot of the portal's masked recovery screen is a useful addition to the file.

Expect to attend in person. This is the whole point of the exercise: the department is being asked to move the recovery route for a tax account onto a new device, and it will want a human being with matching identity documents in front of it. That also means expect the visit to expose any inconsistency in the record. If the name spelling on your PAN registration does not match your citizenship certificate, or the date of birth differs, the contact change may stall behind a correction to the underlying record — an annoying but genuine reason to do this well before you need it.

Plan around office hours, which the Inland Revenue Department publishes on ird.gov.np: Sunday to Friday working arrangements aside, the department lists winter hours of 09:00 to 16:00 from 31 October to 14 February and summer hours of 09:00 to 17:00 from 15 February to 30 October, with public holidays closed. The department's head office sits at Lazimpat in Kathmandu and publishes a general line on 01-5970081 and a service email at [email protected], with separate IT support contacts including 9762118258 and extensions 208, 209 and 210 on the main number. Ringing ahead to confirm what your specific office wants is worth the call.

When the change is done, do not walk away assuming it worked. Go back to the portal the same day, run the recovery flow again, and confirm that the masked contact details now match your own number and address and that the OTP arrives. Then reset the password and log in. A change that is recorded but not tested is not yet a fix, and discovering the gap in Ashwin defeats the point of having gone at all.

A business PAN behaves differently from a personal one, and the difference trips up staff who assume that whoever has been filing must be entitled to control the account. Credentials on a company PAN belong to the entity. The person who typed them in — an accounts assistant, an outsourced bookkeeper, a director who has since left — holds them on the entity's behalf and has no personal claim to them.

That means an office asked to change the registered contact on a company PAN will look for evidence of authority rather than evidence of involvement. In practice the working set is the entity's own PAN and registration certificates, its incorporation records, a board decision or an authority letter naming the individual attending and what they are authorised to do, that individual's citizenship certificate, and the company stamp. Company registration particulars in Nepal are held by the Office of the Company Registrar in Tripureshwar, which operates under the Ministry of Industry, Commerce and Supply and administers company registration and post-incorporation matters through its CAMIS system — so an extract from that record is the natural way to demonstrate who your directors are.

Sole traders and single-person firms sit closer to the individual case. If the business is legally you, your citizenship certificate and the firm's registration are usually the substance of it. Partnerships fall in between, and the office will normally want the partnership deed alongside a written authority from the partners rather than one partner's say-so.

Being an ICAN-registered chartered accountant does not, by itself, confer authority over a client's portal credentials. The Institute of Chartered Accountants of Nepal registers members, certificate-of-practice holders and audit firms and maintains professional standards and a code of ethics for them, which is a good reason to engage a registered professional — but the mandate to change a tax registration record comes from the client, in writing, not from the adviser's qualification.

If you are changing accountants, build the handover list into the engagement letter rather than discovering it later. You want the portal user ID; the registered mobile number and email moved to addresses the company controls; copies of returns filed and their acknowledgements; VAT and e-TDS credentials where those are separate; and the identity of the Inland Revenue Office or Taxpayer Service Office your PAN sits with. A departing adviser who is asked for this at the start of the relationship almost always provides it; one asked for it during a dispute often does not.

The structural fix, for any business with more than one person in it, is to register a role-based company email address — accounts@ or tax@ your own domain — rather than an individual's personal mailbox, and to attach a company-controlled SIM rather than a staff member's private number. Neither costs anything meaningful, and both mean the next resignation does not lock the business out of its own tax filings.

The timing argument is the part of this guide most likely to save you money. Section 96 of the Income Tax Act 2058 requires each person to submit an income return within three months of the expiry of an income year, together with the assessable income figures, tax computed, amounts already withheld or paid in instalments, the balance still due, and the supporting certificates the department specifies. Nepal's income year runs Shrawan to Ashad, so for most taxpayers that three-month window closes in Ashwin. Everything about the portal gets harder in the last week of it.

Section 98 provides the safety valve, and it is narrower than people assume. A person required to file may apply in writing to the department for an extension, and the department may extend the time limit — at one time or several times — for a period not exceeding three months, if it considers the reasons reasonable, notifying its decision in writing. The critical words are "within the time limit for submission of such return". The application belongs inside the original window. Discovering on the final evening that you are locked out and that the registered mobile belongs to your former accountant leaves you with no realistic path to a written, reasoned extension application.

Section 117 explains why this is expensive rather than merely inconvenient. Where a person fails to submit an income return under sections 95 or 96, the section provides for a fee calculated at one and a half percent per year of assessable income for each month and part of a month, or one thousand rupees per month, whichever is higher — with a parallel charge where a withholding return under section 90 is not submitted. Those parameters are set by the Act as amended, and Finance Acts revise tax provisions annually, so treat the mechanism as the durable part and confirm the current numbers with the department before relying on them.

Read the two sections together and the practical rule writes itself. A late return is charged by reference to elapsed months, so the cost of a lockout is measured in the time it takes you to resolve it — and the resolution path for the worst case is a counter visit at an office that keeps ordinary working hours and is at its busiest precisely when you need it. A lockout discovered in Shrawan is a form and a bus ride. The same lockout discovered in the last week of Ashwin is a fee that accrues while you queue.

So build a calendar habit. Once the income year ends in Ashad, log into the portal on an ordinary working day for no reason other than to confirm that you can. Check that the registered mobile is still your number and that the email still reaches you. If either is wrong, you have weeks rather than hours to fix it. This is a five-minute test that removes the single most common cause of a missed deadline that had nothing to do with the tax itself.

The same argument applies to anything downstream of a filed return. A tax clearance certificate is routinely demanded for tenders, bank facilities, licence renewals and visa paperwork, and the department's verification tool at ird.gov.np/tax-clearance checks a clearance by PAN, fiscal year and clearance number — all of which presuppose a return that was actually filed and processed. A locked portal in Ashwin becomes a failed tender in Poush. Fix the account when it is a nuisance, not when it is a blocker.

A predictable industry has grown up around this exact search, and it peaks at deadline. The rule that defeats most of it is short: nobody from the Inland Revenue Department will telephone you to ask for your portal password or to read back an OTP. An OTP exists to prove that a device is in your hands. The moment you speak one aloud, it has proved that to somebody else.

The second rule is to be strict about domains. The department's own site is ird.gov.np and the portal is taxpayerportal.ird.gov.np. Anything else — a .com imitation, a shortened link in a Viber group, a sponsored search result promising instant IRD password recovery — should be closed rather than investigated. Getting into the habit of navigating from ird.gov.np every time costs you nothing and removes the entire category of look-alike sites at a stroke.

Be sceptical of messages about refunds, penalties or account suspension that arrive by SMS or messaging app with a link attached. Nepal's income tax administration works through the portal and through its offices; an unexpected message asserting that your PAN is blocked and inviting you to log in via a link is a phishing pattern, not a notice. If you want to know your standing, go to the portal directly or ring your Inland Revenue Office.

If you have already handed over credentials or an OTP, treat it as a live incident. Change the portal password immediately from a device you trust, check what has been submitted under your account, and tell your Inland Revenue Office in writing that the account may have been accessed by someone else. Where money or a criminal act is involved, Nepal Police's Cyber Bureau takes cybercrime complaints and publishes its contacts — 9851286770 and 01-5319044, with [email protected] for correspondence — alongside the general police emergency number 100. A complaint that names dates, numbers and screenshots is far more actionable than one that describes a feeling.

The same discipline applies to identity documents. Recovering a tax login sometimes requires you to show a citizenship certificate or a National Identity Card, issued through the Department of National ID and Civil Registration under the Ministry of Home Affairs. Show those at a government counter. Do not photograph them for a stranger on a messaging app who has promised to sort out your portal, and do not upload them to a site you reached from a search advertisement.

Finally, shrink the recovery surface permanently. One SIM you control, registered against your PAN. One email address you control, with two-factor authentication on the mailbox itself, because an attacker who owns your email owns a great deal more than your tax portal. Government service accounts increasingly cluster around the same contact details — the Nagarik App is built on that premise — so the mobile number and mailbox attached to your PAN are worth protecting with more care than most people give them.