Tax and SARS knowledge base
How does SARS MobiApp passwordless login work?
How does SARS MobiApp passwordless login work, and how is it different from biometric and OTP controls?
Last reviewed:
Direct answer
SARS says passwordless login lets you access your eFiling profile by entering your username, then approving a push notification on your enrolled smart device. It does not require your eFiling password at that login. To use it, the SARS MobiApp must be installed on a smart device that is enrolled as the primary device on your eFiling profile and connected to the internet through Wi-Fi or data.
Passwordless login is not the same as biometric login or two-factor authentication, or 2FA. Biometric login depends on the Face ID or fingerprint setting of the device. SARS describes 2FA as a username-and-password login followed by the selected security process, which can include an OTP. Passwordless login has its own primary-device enrolment and push-approval workflow.
What this means in practice
The practical benefit of passwordless login is that a taxpayer uses a username and approves a push request on the enrolled primary device instead of entering the ordinary eFiling password. The device must be available and connected when the request is made. If the connection drops, SARS indicates that the request may not complete.
Biometric login is a separate setting. SARS says it can be enabled only where the device supports Face ID or fingerprint authentication. It is a local device preference, not the passwordless push-approval method. Two-factor authentication is also separate: it uses a username and password, followed by the applicable security confirmation or OTP process.
Keep the starting question clear. A new taxpayer may need income-tax registration and MobiApp registration. An existing taxpayer may only need secure app access. A successful passwordless login does not show that a return has been filed, that an assessment is correct, or that a refund is payable.
Step-by-step
- Confirm that you are using the official SARS MobiApp. Download or update it only from the official app store route identified by SARS. Do not use a link sent in an unsolicited message.
- Confirm the prerequisites. The device must have the SARS MobiApp installed, be enrolled as the primary device on your eFiling profile, and have Wi-Fi or mobile data. If you changed devices, complete the official enrolment process before relying on passwordless login.
- Enable the correct method from the official eFiling profile path. SARS directs users to My Profile, Profile and Preference Setup, then either Two-Factor Authentication or Passwordless Login. These methods cannot both be enabled at the same time.
- Enrol the primary device. Follow the official QR-code enrolment steps, select the approved contact method where prompted, and complete the device-enrolment OTP. This OTP finalises enrolment. It is not the passwordless login itself.
- Use passwordless login. Enter your username on eFiling. SARS says a message will be sent to the device linked to the profile. Tap the notification, review the request in the SARS MobiApp, then approve it only if you initiated the sign-in.
- Keep alternatives distinct. Use biometric authentication only if the device supports Face ID or fingerprint and the setting is enabled. Use 2FA only with your username, password and the required OTP or other selected security confirmation.
- Keep the device secure. Use your own screen lock, install updates, and remove or re-enrol access promptly if the device is lost or replaced. Decline any push request that you did not initiate and verify suspicious activity through an official SARS channel.
Documents and records to keep
Keep the taxpayer reference details that identify you, current contact information, primary-device enrolment confirmation and a short dated record of an access issue if it needs escalation. Save any SARS request for documents or further validation separately.
Do not keep your password, OTP, biometric image or security answers in the same file. A useful record is that access was established or that an OTP challenge occurred, not the security credential itself. If a device is lost, first secure the email and mobile accounts that may receive verification messages.
Important limits and exceptions
SARS can change app screens, device requirements and available authentication options. This guide therefore does not promise that passwordless login will be available for every device, user or tax service. It requires an enrolled primary device with the app installed and an internet connection. Follow the current in-app wording and verified SARS guidance.
A successful passwordless approval is not proof that SARS has completed every registration or document validation. An OTP used to enrol the device is different from a passwordless push approval, while a Face ID or fingerprint setting is a different device control. Do not create a second profile or alter factual details to move past a validation message.
When to get tailored advice
Get help if your tax number appears linked to another profile, biometric validation fails repeatedly, an old security contact cannot be changed, or the app displays a request you cannot reconcile with your SARS records. Report suspected phishing through a verified SARS channel. TaxProof can help organise the facts and identify questions for SARS or a practitioner, but cannot override app security or access credentials.