How can I protect my USCIS account when I receive codes or need help signing in?
Use the official account interface, protect the account's unique credentials and authentication codes, and preserve recovery information privately. Distinguish an official security step from a third party asking for access. This guide organizes security checks and support questions without requesting credentials, changing an account or guaranteeing protection from misuse.
Sources: USCIS Online Account legal terms · Online account overview outreach PDF · USCIS Contact Center · Checked October 25, 2026
What this guide covers
- Check the domain before entering credentials
- Treat authentication and recovery codes as private
- Define assistance without surrendering account ownership
At a glance
- Check the domain before entering credentials before proceeding with this task.
- Treat authentication and recovery codes as private and preserve the source record.
- Use the current official instructions and keep a dated record of the actual result.
Check the domain before entering credentials
Open the known official account destination instead of trusting an unexpected message link. Compare the actual domain and the purpose of the prompt. A logo, familiar case word or urgent tone does not establish that a message belongs to USCIS. Keep an inquiry about a suspicious prompt separate from any action on the underlying immigration case.
Treat authentication and recovery codes as private
The official account materials discuss generated verification credentials and a backup code for loss of access to the original verification method. Store recovery information where the account owner can retrieve it privately. Do not put a current code in a public forum, directory correction, shared intake spreadsheet or message to someone who only needs to explain a form.
Define assistance without surrendering account ownership
A translator, family member or document assistant may help explain a screen, but that role does not make the person an authorized legal representative or account owner. Ask what access is actually needed and use the relevant official process. Avoid leaving credentials on another person's device or assuming a saved browser session will remain private.
Use official support for access failures
Record the error wording and when it occurred without collecting passwords or active security codes in the troubleshooting note. The official Contact Center resource identifies online-account technical support as a separate task. A login failure does not prove that a case was denied, that a filing disappeared or that a new application should be submitted.
Preserve evidence of the security issue safely
If an unexpected request or access change occurs, keep the message, destination and date in a private record and seek official assistance. Do not expose full notices or identifiers while asking others what happened. No security workflow in this publication can certify an account's condition, recover access automatically or decide the effect on an immigration matter.
| Review step | Record or question | Boundary |
|---|---|---|
| Check the domain before entering credentials | Open the known official account destination instead of trusting an unexpected message link. | Check against the actual official instruction or document |
| Treat authentication and recovery codes as private | The official account materials discuss generated verification credentials and a backup code for loss of access to the original verification method. | Check against the actual official instruction or document |
| Define assistance without surrendering account ownership | A translator, family member or document assistant may help explain a screen, but that role does not make the person an authorized legal representative or account owner. | Check against the actual official instruction or document |
| Use official support for access failures | Record the error wording and when it occurred without collecting passwords or active security codes in the troubleshooting note. | Check against the actual official instruction or document |
Prepare your next questions
0 of 5 complete
Download the designed PDF checklist to mark on screen or print. Your selections on this page stay here.
Version: October 25, 2026.
Go to the source
Sources & verification
Follow the institution that owns the requirement and check its current instructions.
Common questions
Is a two-step verification code appropriate to post in a help forum?
No. Treat authentication and recovery information as private. A troubleshooting explanation can describe the prompt and error without revealing a usable code or password.
Sources: USCIS Online Account legal terms · Online account overview outreach PDF · USCIS Contact Center · All 4 sources
Does a website helper become my immigration representative by signing in?
Account access and legal representation are separate issues. Use the official representative process and verify the professional rather than treating possession of a password as authorization.
Sources: USCIS Online Account legal terms · Online account overview outreach PDF · USCIS Contact Center · All 4 sources
Does being locked out mean USCIS denied my case?
A technical access problem is not a decision notice. Use official support to resolve the access issue and preserve any actual case correspondence separately.
Sources: USCIS Online Account legal terms · Online account overview outreach PDF · USCIS Contact Center · All 4 sources
What information can I record without exposing credentials?
Keep the official domain, error wording, date and the action attempted. Do not include secret credentials, active codes or unnecessary personal identifiers in a public support request.
Sources: USCIS Online Account legal terms · Online account overview outreach PDF · USCIS Contact Center · All 4 sources
About this guide
By Immigrant Insider editorial desk. Updated .
Report outdated information