August 11, 2022 │Office of Communications
We are taking your Permits Online account security to the next level with a new login process. Starting September 8, 2022, Permits Online will require you to enter a one-time verification code—a code we send you each time that you sign-in to the system.
The good news? This added layer of protection will not require you to remember anything beyond your username and password.
Permits Online and the One-time Verification Code
We are adding one of the most common types of system security to Permits Online: the one-time verification code. In other words, rather than simply asking for a username and password, the new sign-in will require a second factor, the one-time verification code, to confirm your identity.
To learn more about the new sign-in process, see Permits Online: How to Use One-time Verification Code.
IMPORTANT: Please check the email address associated with your Permits Online account and make sure you have access to that email.
Why is TTB making this change?
For many years, the standard combination of a username and password has been considered a reasonably secure way to verify your identity and limit account access to authorized users. While important, usernames and passwords are vulnerable to cyber-attacks and can be stolen by third parties. As cyber threats become more and more difficult to thwart, multiple security layers are key to protecting online systems and applications.
Additionally, the President’s Executive Order (EO) 14028 on Improving the Nation’s Cybersecurity requires all federal government agencies to employ and fully adopt multi-factor authentication (MFA).
Requiring the one-time verification code (a type of MFA) as an additional sign-in measure for Permits Online meets that requirement and is a good practice for enhancing system security.
Questions?
Call the NRC Call Center at 877-882-3277 / 877-TTB-FAQS between 8 a.m. and 5 p.m. EST, Monday through Friday (except for federal holidays).
Additional Information
Permits Online: How to Use One-time Verification Code
Permits Online: How to Identify Email Associated With Account