E-Way Bill 2FA Is Mandatory: What Every Business and Transporter Must Set Up

If your goods ever stop moving because a login failed, this is why. Since 1 April 2025, two-factor authentication (2FA) is mandatory for every taxpayer and transporter logging into the e-way bill and e-invoice portals — regardless of turnover (ClearTax, 2026). A username and password alone no longer work; an OTP is also required. One nuance trips people up: this applies to the NIC e-way bill/e-invoice portals, not the main GST return portal.

What is 2FA on the e-way bill system?

To secure the e-way bill and e-invoice systems, NIC added a second login step: after your username and password, the system also verifies a one-time password (OTP) (ClearTax, 2026). Once you register for 2FA, it applies to both the e-way bill and e-invoice portals together. Sub-users of a GSTIN authenticate separately using their own registered mobile numbers.

When did it become mandatory?

GSTN rolled it out by turnover. Per a GSTN advisory dated 17 December 2024, 2FA became mandatory for taxpayers with AATO above ₹20 crore from 1 January 2025, above ₹5 crore from 1 February 2025, and for all remaining taxpayers and transporters from 1 April 2025 (IndiaFilings, 2026). So 2FA now applies to every user regardless of size.

How do I receive the OTP?

Three methods. SMS sends the OTP to your registered mobile number. The government's Sandes app receives OTPs in-app. The NIC-GST-Shield app generates OTPs offline — no internet or mobile network needed — and can be downloaded only from the e-way bill/e-invoice portal (ClearTax, 2026). For businesses in low-signal warehouses or transit hubs, NIC-GST-Shield is the most reliable option.

Why was 2FA introduced?

To curb fraud. There were cases where a taxpayer's GST account was misused to generate e-way bills while the goods were actually moved by someone else (CAalley, 2025). 2FA makes credential theft far harder. Even where enforcement was briefly lenient at the April 2025 deadline, the advice from experts was the same: register now to avoid business disruption.

Frequently Asked Questions

Is 2FA mandatory for the GST portal login?

No. 2FA is mandatory for the NIC e-way bill and e-invoice portals, not the main GST return-filing portal. Many businesses confuse the two. If you generate e-way bills or e-invoices, you must use 2FA on those NIC systems regardless of your turnover, effective 1 April 2025.

Does 2FA apply to my small business below ₹5 crore turnover?

Yes. After a phased rollout, 2FA became mandatory for all taxpayers and transporters from 1 April 2025, regardless of turnover. Any business or transporter that logs into the e-way bill or e-invoice system must complete OTP-based authentication at every login.

How can I get the OTP without internet access?

Use the NIC-GST-Shield app. Unlike SMS or the Sandes app, NIC-GST-Shield generates the OTP offline without any internet connection or mobile network. Download it only from the official e-way bill/e-invoice portal, then sync it once to generate time-based OTPs thereafter.

How do sub-users of a GSTIN handle 2FA?

Each sub-user authenticates separately based on their own registered mobile number in the e-way bill/ e-invoice system. Once 2FA is registered for an account it applies to both the e-way bill and e-invoice portals, so keep every active user's contact details current to avoid lockouts.

What should you do next?

Register every active user and sub-user for 2FA now, install NIC-GST-Shield on the devices your dispatch team uses, and verify the mobile numbers on each GSTIN are current — not a former employee's. For help keeping movement and filing compliant, see Bizeract monthly GST return filing and our 2025 GST portal changes guide.