GST Alert: Two-Factor Authentication and Six-Digit HSN Code on GST Portal

The GSTN (Goods and Services Tax Network) has issued important compliance advisories affecting all registered taxpayers in India. Two significant changes, the rollout of two-factor authentication (2FA) for GST portal login and the mandatory use of six-digit HSN codes in GST filings, require immediate attention from businesses and their authorized signatories. This advisory provides a structured overview of both updates, their phased implementation, and what your business needs to do to stay compliant.

Two-Factor Authentication (2FA) for GST Portal Login

What Is the Change and Why It Matters

GSTN has introduced two-factor authentication (2FA) to strengthen login security on the GST portal. In an environment of rising cyber threats and fraudulent GST registrations, 2FA adds a critical second layer of identity verification beyond the standard username and password combination. For businesses and tax professionals accessing the portal on behalf of clients, this change directly impacts day-to-day login workflows.

Phased Rollout States and Timeline

The 2FA rollout was conducted in a phased manner to ensure a smooth transition:

• Pilot Phase: Haryana (successfully implemented and operational)
• Phase 1: Punjab, Chandigarh, Uttarakhand, Rajasthan, and Delhi — rolled out from 1^st December 2023
• Phase 2: Nationwide rollout across all remaining states and union territories

Taxpayers in Phase 1 states were the first to experience the new login requirement outside the pilot. The nationwide expansion that followed means all registered taxpayers across India are now within the scope of this security upgrade.

How the OTP-Based Authentication Works

Once 2FA is enabled, taxpayers must complete the following login sequence:

1. Enter the registered username and password on the GST portal
2. An OTP (One-Time Password) is automatically generated and sent to the Primary Authorised Signatory’s registered mobile number and email ID
3. Enter the OTP to complete the login process

Importantly, the OTP is triggered only when a taxpayer logs in from a new or changed device, browser, or location. Logins from recognised, previously used systems may not require OTP re-entry each time, reducing friction for routine access.

Action Required: Update Your Authorised Signatory Details

To ensure uninterrupted portal access, all taxpayers are strongly advised to verify and update the mobile number and email ID of their Primary Authorised Signatory on the GST portal immediately. If these details are outdated or inactive, the OTP will not be received, effectively locking the taxpayer out of their account during a filing or compliance deadline.

Steps to update Authorised Signatory contact details:

• Log in to the GST portal at gstin.gov.in
• Navigate to My Profile > Authorised Signatory
• Update the registered mobile number and email ID
• Save and verify using the confirmation OTP

Businesses that operate with multiple login users including tax consultants, CFOs, and compliance teams should audit their authorized signatory records promptly as part of routine GST advisory and compliance hygiene.

Mandatory Six-Digit HSN Code in GST Filings

Overview of the HSN Code Mandate

In a parallel compliance development, GSTN has made the use of six-digit HSN (Harmonised System of Nomenclature) codes mandatory for taxpayers meeting the specified turnover threshold. HSN codes classify goods and services systematically and are a foundational element of correct GST invoice generation, GSTR-1 reporting, and e-invoice compliance.

The requirement was introduced in a phased manner aligned with aggregate annual turnover:

Where Six-Digit HSN Codes Apply

The mandatory six-digit HSN code requirement applies to the following GST compliance touchpoints:

• Tax invoices: All B2B and B2C invoices must carry the applicable HSN code
• GSTR-1 / IFF filings: Table 12 of GSTR-1 requires HSN-wise summary of outward supplies
• E-invoices: For taxpayers covered under e-invoicing, the IRN generation system validates HSN codes before generating the Invoice Reference Number
• GSTR-9 (Annual Return): HSN summary must reconcile with the outward supplies declared during the year

Non-compliance or incorrect HSN reporting can trigger discrepancies during GST scrutiny, impact input tax credit (ITC) eligibility for counterparties, and attract penalty proceedings. Businesses should review their ERP and billing systems to ensure HSN codes are correctly mapped and are at the required digit level.

Common Compliance Gaps to Watch

Based on common patterns observed during GST health checks, businesses frequently encounter:

• Four-digit HSN codes still configured in ERP or billing software despite the six-digit mandate
• Incorrect HSN classification for goods that span multiple chapters
• Mismatches between HSN in e-invoices and GSTR-1, leading to auto-populated errors in GSTR-2B
• Missing HSN codes on B2C invoices for taxpayers with turnover above ₹5 crore

A structured GST health check can help identify and remediate these gaps before they escalate into audit findings or demand notices.

Compliance Implications for Businesses

Both the 2FA mandate and the six-digit HSN code requirement reflect GSTN’s broader push toward system-driven compliance verification. As the GST ecosystem becomes more technology-enabled with real-time data matching across GSTR-1, GSTR-3B, e-invoices, and e-way bills businesses that rely on outdated processes or incomplete data face increasing exposure to automated scrutiny flags.

Key compliance priorities arising from these advisories:

• Update authorised signatory details on the GST portal without delay
• Audit HSN code mappings across your product or service master in billing and ERP systems
• Reconcile HSN data across GSTR-1, e-invoices, and GSTR-9 for previous periods if discrepancies exist
• Train internal teams on the new login workflow to avoid access disruptions during filing windows

For businesses that handle complex multi-state GST compliance or maintain large SKU catalogs, proactive support from experienced indirect tax advisors can significantly reduce compliance risk during this transition.

If your business has received a notice or is facing scrutiny related to HSN classification or portal access issues, MBG’s assistance in GST audit by department team can provide end-to-end support in responding to and resolving departmental proceedings.

Additional Resources

For further reading on related GST compliance developments, refer to the following MBG advisories:

• Advisory on GSTR-3B and GSTR-1: Key reconciliation and filing guidance
• GST Update: New Form DRC-03A and E-Invoice Notification: Recent changes to e-invoicing and demand recovery
• Gist of Circulars from the 53rd GST Council Meeting: Summary of key CBIC circulars
• Invoice Management System in GST: Understanding the IMS framework and its impact on ITC
• CBIC Reduces GST E-Invoicing Turnover Limit from ₹10 Crore to ₹5 Crore: Expanded e-invoicing applicability

For queries on GST portal compliance, HSN classification, or assistance with departmental audits, contact MBG’s GST advisory and compliance team.