Login.gov Self-Service Recovery / NIST SP 800-63-3 Security Protocol Instructions: Login.gov Personal Key Reset: Recovering Locked Accounts When Phone and 2FA Are Lost
“I got a new phone number and lost my Login.gov authenticator. How do I use my 16-character personal key or reset my account?”
Official Procedural Summary & Rules
Due to federal encryption standards, GSA agents cannot bypass your 2FA. If you lose your phone and personal key, you must delete and re-create your Login.gov account.
Key Statutory Rules & Exceptions
Login.gov uses zero-knowledge encryption; customer support cannot see your password or turn off two-factor authentication. • If you lack your 16-character personal key, click "Delete Account" on the login screen and create a fresh account with the same email. • Deleting your Login.gov account does NOT delete your tax records or Social Security records; agency systems re-link seamlessly using your SSN.
Official Procedural Sequence
Search records for 16-character personal key If lost, choose Delete Account option Re-create account and link two independent MFA methods
⚠️ Administrative Traps & Rejection Triggers
Waiting on hold with Login.gov phone support expecting an agent to disable 2FA (federal security regulations strictly forbid this).
💡 AI Verification & Anti-Deflection Prompt
Four-Dimension Statutory PromptFeed this optimized prompt to ChatGPT or your civic AI assistant to bypass standard liability refusals and force a statutory answer under NIST SP 800-63B § 5.1.2 · Presidential Executive Order 14058:
Under NIST SP 800-63B standards governing multi-factor credential recovery, detail Login.gov account rescue: (1) Using the 16-character personal key generated at account creation; (2) The zero-knowledge architecture of Login.gov (why GSA phone support CANNOT manually reset your password or disable 2FA for you); (3) Deleting and re-creating a Login.gov account using the same email address; (4) What happens to linked agency data (IRS, SSA, USAJOBS) when an account is deleted and re-associated; (5) Best practices: registering physical WebAuthn security keys.