ImmiAccount Password Reset and Locked Account: Step-by-Step Recovery

ImmiAccount Password Reset and Locked Account: Step-by-Step Recovery starts with one of four causes — five failed password attempts (which triggers an automatic lockout), an expired or wrong MFA code, a forgotten password, or wrong answers to your security questions. The fastest fix in most cases is to wait four hours for the automatic unlock if you remember your password, or to run the Forgot Password flow if you don't. Everything else — MFA recovery, browser fixes, support escalation — is a fallback for the small percentage of cases where those two paths fail. For account creation and general portal use, see the ImmiAccount Guide: Create and Manage.

Step-by-step: Reset your forgotten ImmiAccount password

1. Go to the ImmiAccount login page: https://online.immi.gov.au/lusc/login
2. Click "Forgotten password?" below the login fields.
3. Enter the username for your ImmiAccount. The forgotten-password flow asks for your username, not your email address — if you have forgotten that too, run the "Forgotten username" link first, which asks for the email address associated with the account and emails back the usernames of every account registered to it.
4. Answer your security questions exactly as you set them at registration — capitalisation and spacing matter on some answers.
5. Check your inbox for the password reset email. Also check your spam, junk, and promotions folders. Add homeaffairs.gov.au to your safe-sender list before requesting a second reset email.
6. Click the reset link as soon as it arrives, and check the message itself for any expiry window. Home Affairs will never email you a temporary password — an email that contains one is a scam.
7. Set a new password that meets the current policy: a minimum of fourteen characters and a maximum of 100, using at least three of these four character sets — lowercase letters (a-z), uppercase letters (A-Z), digits (0-9), and punctuation or special characters. Passwords cannot be reused for eight password changes.
8. Return to the login page and sign in with the new password.

Where most resets fail: step 4. Security questions set years ago, often during a previous student or visitor visa application, are easy to misremember. Save the answers in a password manager the moment you set them. Without them, the Forgot Password flow ends here and you'll need the Technical Support Form (covered below).

Step-by-step: Unlock a locked ImmiAccount account

1. Confirm the lockout. The error on screen will explicitly say your account is locked — not a generic "incorrect password" message. ImmiAccount locks the account after 5 incorrect username or password attempts in a row.
2. Option A — Wait 4 hours. ImmiAccount auto-unlocks the account 4 hours after the lockout. If you remember your password, this is the fastest path: walk away from the login page, come back after the window, and sign in normally.
3. Option B — Use the Forgot Password flow. Running the reset (steps in the section above) lets you regain access without waiting. A successful reset clears the lockout state.
4. If you've forgotten your password and your security question answers, neither option works. Skip ahead to the Technical Support Form section — you'll need a manual reset by the Department.

Do not keep retrying the password during the 4-hour window. Repeated attempts won't shorten it. Close the tab and come back after the window.

Multi-Factor Authentication (MFA) issues

MFA is not optional: you are prompted to set it up when you create your ImmiAccount, and once it is enabled every login needs a 6-digit code from an authenticator app or an email token. Home Affairs names Google Authenticator, Microsoft Authenticator and Duo Mobile as examples and states plainly that the Department does not have its own authenticator app — so anything in an app store calling itself the official ImmiAccount authenticator isn't. Email tokens stay valid for 15 minutes, but the Department says email authentication is less secure than an app and should be chosen only if absolutely necessary. MFA adds a second failure point during recovery: fixing your password doesn't help if you can't pass MFA.

MFA code rejected

• Check your device clock. TOTP codes are time-based; if your phone's time drifts by more than ~30 seconds, every code will be rejected. Enable automatic time sync.
• Refresh the authenticator app and use a freshly generated code (not one about to expire).
• Request a new email code rather than retyping the old one.

Lost access to your authenticator device

• New phone, factory reset, or a deleted app: use the "I no longer have access to my multi-factor authentication app" link on the ImmiAccount login page. You will need your password and the correct answers to your secret questions, and you will then have to set up MFA again from scratch.
• If the secret questions stop you too, the Technical Support Form below is the remaining route.
• Prevention: there are no MFA backup or recovery codes to save — the official setup does not issue any. What gets you back in is your secret question answers, so store those in a password manager.

Email MFA codes not arriving

• Spam, junk, and promotions folders.
• Email forwarding rules sending Home Affairs mail to an unread archive.
• Allowlist homeaffairs.gov.au.
• Corporate mail servers sometimes strip or delay government emails. Switch to a personal email once you regain access.

Browser and technical fixes for common login problems

Before assuming you have a password or lockout problem, eliminate the browser-level issues that mimic both.

• Try a different browser, on a current version. Home Affairs does not publish a supported-browser list, and switching browsers is its own first-line fix — do that before troubleshooting anything else.
• Disable VPN and proxy. Home Affairs services have historically had friction with VPN traffic, especially from data-centre IP ranges. Connect via your normal home or mobile network and retry.
• Clear your temporary internet files, cookies, browsing history and download history. Stale session cookies are a common cause of phantom login failures, and the Department's own advice is to do this a few times to be sure.
• Disable extensions. Ad blockers, script blockers, and aggressive password managers can interfere with the login form's behaviour. Turn them off for the Home Affairs domains or test in a clean browser.
• Try an incognito or private window. This rules out extensions and cached state in one step.
• Check your system clock. MFA codes depend on accurate time. Enable automatic time sync on Windows, macOS, and your phone.

If login works in an incognito window but not your normal browser, the cause is an extension or cached cookie, not your account.

When auto-unlock and password reset both fail — escalate to technical support

If you've waited the four hours, tried the Forgot Password flow, and the security questions or MFA still won't let you in, you need a human at Home Affairs.

ImmiAccount Technical Support Form — the primary escalation route. Submit at: https://immi.homeaffairs.gov.au/help-support/departmental-forms/online-forms/immiaccount-technical-support-form

Fill in your registered details, your registered email, and describe the problem clearly (locked account, lost MFA device, security questions not accepted). Attach screenshots of error messages if asked.

Global Service Centre (phone) — faster than the form for time-sensitive lockouts.

• Within Australia: 131 881 (Mon-Fri, 9am-5pm your local time — closed on Australian national public holidays, and Monday is the peak day)
• Outside Australia: +61 2 6196 0196

Have these ready before you call or submit the form:

• The exact email address registered to the ImmiAccount.
• Your full legal name as registered (matching your passport).
• Your date of birth.
• Any TRN (Transaction Reference Number) from existing or past applications — this is the strongest identifier you can give them.
• Passport number(s) used in applications linked to the account.

When this doesn't work — protecting your visa application

A locked ImmiAccount does not pause your visa application deadlines. The Department's processing clock and any "respond by" dates keep running while you're locked out. For deadline-sensitive cases, the order of operations matters.

• For a deadline-sensitive lockout (response due in days, not weeks), call the Global Service Centre on 131 881 or +61 2 6196 0196. The phone queue typically resolves urgent account issues faster than the Technical Support Form.
• If a paper form is your last option, most subclasses are now digital-by-default and paper forms are no longer accepted for many visa types. Confirm acceptance with the Department before relying on this path.
• If a Bridging Visa is at risk because you can't lodge or respond inside the portal, contact a MARA-registered migration agent immediately. A registered agent can lodge from their own ImmiAccount on your behalf while your personal account is being recovered.
• Document the lockout. Screenshot the error, timestamps, and your support ticket reference. You'll need this evidence if the lockout causes a missed deadline.

For codes you see during a locked or failed login, see ImmiAccount Error Codes Explained. If an existing application isn't showing in your dashboard, see ImmiAccount: How to Link an Existing Application — that's a linking issue, not a lockout.

How to prevent future ImmiAccount lockouts

• Use a password manager. Store the password and the security question answers in the same vault entry.
• Set MFA via authenticator app rather than email. Email is slower, more prone to delivery failure, and easier to lose access to.
• Do not go looking for MFA backup codes — ImmiAccount does not issue any. If you lose your device, the way back in is the "I no longer have access to my multi-factor authentication app" link, which checks your password and your secret questions.
• Save every TRN somewhere accessible — a note in your password manager works. TRNs are the fastest identifier when escalating to support.
• Bookmark https://online.immi.gov.au/lusc/login and use the bookmark every time. Phishing sites imitating ImmiAccount are common and they steal credentials you'll then have to reset.
• Update your registered email if you're about to lose access to the current one (job change, university account expiry). Do this before you lose access, not after.

FAQ

How long does an ImmiAccount account stay locked?

ImmiAccount auto-unlocks 4 hours after a lockout from failed login attempts. You don't need to do anything during that window — the account becomes available again automatically. If you complete a successful password reset via the Forgot Password flow, the lockout clears immediately and you don't need to wait.

Can I create a new ImmiAccount if I can't recover the old one?

You shouldn't. Home Affairs does not publish a one-account rule, but usernames are unique and can never be changed or re-used — even if you delete the account — and creating a second account to bypass a lockout causes downstream problems with importing your existing applications. Use the Technical Support Form to recover the original account instead.

Will being locked out of ImmiAccount affect my visa application?

Yes, indirectly. The lockout itself doesn't change your application status, but it can stop you from responding to a request for information, uploading documents, or paying fees by their deadlines. Processing clocks and "respond by" dates keep running while you're locked out. Treat any lockout near a deadline as urgent and call the Global Service Centre.

How do I update my ImmiAccount email address?

Log in, open your account settings (usually under your name in the top-right of the dashboard), and update the registered email. You'll need to verify the new address via a link sent to it. If you've already lost access to the old email and can't log in, you'll need to update it via the Technical Support Form with proof of identity.

Is the official Home Affairs phone support free to call from overseas?

No. The overseas number +61 2 6196 0196 is a standard international call charged at your carrier's usual rate. The within-Australia number 131 881 is a local-rate call. If cost is a concern, use the Technical Support Form for non-urgent issues and reserve the phone line for deadline-sensitive cases.