Pennsylvania will be rolling out a new security measure for accessing the Unemployment Compensation Management System (UCMS) on June 10, 2023. The PA UCMS is typically used for tax related purposes such as quarterly tax filings, updating a power of attorney, or viewing tax rate and other tax related correspondence.
This new system will require employers who access the system to verify their account by inputting a one-time passcode. This passcode will be sent to the email address you use to login to the system and is only valid for 15 minutes. We recommend that employers who need access to the system verify their account before June 10th in case there are any issues that arise. The official communication from the State of PA is included for more information.
The Office of Unemployment Compensation Tax Services (UCTS) takes the protection of data very seriously and understands that confidentiality, integrity, and availability are vital to our employer and third-party administrator community. In June 2023, we will provide another level of security to protect your data with the implementation of Multi-Factor Authentication (MFA) technology.
Beginning June 10, 2023, UCTS will require employer and third-party administrators to use MFA when logging into the Unemployment Compensation Management System (UCMS) at www.uctax.pa.gov. Upon logging into UCMS with a valid User ID and password, an email will be sent to the email address associated to the User ID. The email will contain a one-time passcode that will need to be entered to authenticate the User ID before you can gain access to UCMS.
In preparation for MFA, from March 18, 2023 to June 9, 2023, employer and third-party administrator users will be required to confirm or update the email address associated to their User ID upon login to UCMS.
What is Multi-Factor Authentication?
Multi-Factor Authentication (MFA) refers to an additional layer of security that is added to the login process.
MFA relies on two forms of authentication: something you know, and something you have with you. The something you know is your password. The something you have with you can be your email account. This means that even if your password is hacked, your account will remain secure.
What applications/systems are currently protected with MFA?
The Unemployment Compensation Management System (UCMS).
Who is impacted by MFA?
MFA is required for all employer and third-party administrator users accessing the Unemployment Compensation Management System (UCMS).
Why do we require employers and third-party administrators to use MFA?
MFA has been around for some time, and many individuals already use it to secure their personal accounts (banking, email, shopping, etc.). Computer systems are under constant attack, with the most common being password attacks, where attackers send thousands of logins using usernames and passwords harvested from the dark web. Attackers use these phishing attacks to attempt to get your username and password. MFA stops most of these attacks.
How often do I have to re-authenticate?
You will need to re-authenticate on each device and each browser you use.
Upon login to the Unemployment Compensation Management System (UCMS), if you select the device as a private device, you should not have to re-authenticate when using that same device and browser in the future. There are two conditions where you may be asked to re-authenticate again: (1) if any activity is considered “high risk” (i.e., multiple login attempts in a short period) and (2) during periodic requests from UCTS to ensure compliance.
What are my authentication options?
The only option available at the initial rollout of MFA on June 10, 2023, is:
One-Time Passcode – A one-time passcode that is valid for 15 minutes will be sent to the email address associated to the User ID. The most recent received verification code should be entered on the UCMS login screen to gain access to the application.
What if I experience issues with MFA?
You can contact the Employer Contact Center at 866-403-6163 or UC Chat on weekdays from 8:00 AM to 4:30 PM, Eastern Time.
