If you’re applying for any Australian visa other than the ETA, you go through ImmiAccount. Tourist Visa, Student Visa, Work and Holiday, Subclass 600, Transit Visa, even most PR pathways all run through the same online portal at the Department of Home Affairs.
The login itself is simple, but enough small things have changed in the last twelve months that people get tripped up. Multi-factor authentication is now mandatory. Lockouts auto-clear after four hours instead of needing a reset. The official URL still gets confused with several lookalike domains that sit ahead of it on Google.
What ImmiAccount is
ImmiAccount is the Department of Home Affairs’ single online portal for visa applications, citizenship applications, and account-linked services. One account holds multiple applications, links family members’ applications together, and stores messages from case officers about every file you’ve submitted.
For most visa types from Singapore in 2026, the portal is the only path. There’s no paper alternative for the Subclass 600 Visitor Visa, the Subclass 500 Student Visa, the Subclass 462 Work and Holiday Visa, or anything in the PR or skilled migration streams. The ETA is the one exception and runs through its own mobile app instead.
How to log in to ImmiAccount
The official immi login URL is online.immi.gov.au/lusc/login. That is the only legitimate ImmiAccount login page. Bookmark it. The Department also links to it from immi.homeaffairs.gov.au under “Login or create an ImmiAccount”, which is a useful fallback if you forget the direct URL.
To complete an immi australia login from Singapore:
- Open the login page in a current version of Chrome, Edge, Firefox, or Safari. Internet Explorer is no longer supported.
- Enter your username, which is the email address you registered with.
- Enter your password.
- Open your authenticator app and enter the six-digit code shown for your ImmiAccount entry.
The session times out after 30 minutes of inactivity. If you’re working through a long form, save the draft every few screens or you’ll lose progress.
A note on lookalikes: several third-party sites use names like immilogin.org or immiaccount.org and can outrank the real portal in Google. They are not the Department of Home Affairs. Don’t enter your password on anything that isn’t on the immi.homeaffairs.gov.au or online.immi.gov.au domain. The immi gov au login is always on a .gov.au URL.
Creating an ImmiAccount from Singapore
If you’ve never lodged an Australian visa before, you’ll need to create the account before doing anything else. The “Create ImmiAccount” link sits in the bottom-left corner of the login page.
Choose “Individual” as the account type unless you’re a registered migration agent or running an organisation account. Use an email you actually check, because the Department sends document requests, biometrics requests, and decision letters there. A work email you might lose access to is a poor choice. A personal Gmail or Outlook address is safer.
Then you set a password (minimum nine characters, mixed case, numbers, symbols), pick three secret questions and answers, and go through the multi-factor authentication setup. Save the secret question answers somewhere reliable. They’re the only way to recover your account if you lose access to your authenticator app.
One ImmiAccount per person is the rule. If you’re applying for several family members, the standard pattern is one account per applying adult, with parents creating accounts on behalf of children under 18.
Need help setting up your ImmiAccount or starting your first application? A consultation with our team can save you the time of working out which forms apply to your situation before you log in.
Multi-factor authentication: what changed in 2025
From 18 June 2025, the Department of Home Affairs made multi-factor authentication mandatory for every ImmiAccount user. That includes new accounts at sign-up and existing accounts at the next login after the cutoff.
The supported authenticator apps are Google Authenticator, Microsoft Authenticator, Duo Mobile, and LastPass Authenticator. Pick one before you start the registration. SMS codes aren’t offered as an alternative.
The setup adds the ImmiAccount entry to your authenticator using a QR code. Once set, every login requires the current six-digit code from the app. Codes refresh every 30 seconds.
Two practical issues come up often. The first is device time drift: if your phone clock is off by more than a minute, the codes will be rejected. Switch the phone to automatic time sync and the problem usually clears. The second is what happens when you change phones. Without a backup, you’ll need to use your secret question answers to reset MFA and re-register a new device, which is why writing those answers down at signup matters.
What you can do once logged in
The dashboard is plain and functional. There are four sections worth knowing.
New application is where you start any visa or citizenship application from scratch. The form selections cascade based on the visa subclass you choose.
Current applications shows you the status of every application linked to your account, with a per-application page for messages, documents, and payments.
Import application links an application that was lodged separately, including paper applications and applications lodged by an agent on your behalf. You’ll need the Transaction Reference Number (TRN), passport number, date of birth, and nationality of the applicant.
Update us is for changing contact details, withdrawing an application, or notifying the Department of a change in circumstances such as a new passport.
Status messages on a current application are worth understanding. “Received” means the file is in queue. “Initial assessment” means a case officer has it. “Further assessment” usually means the Department asked you for something and is waiting on your response. “Finalised” means a decision has been made and the email or letter is on its way. Our Australia visa processing time guide covers what each status realistically means for your timeline.
The messages section is where the Department actually communicates with you. Email notifications go out, but they land in spam more often than they should, so log in once a week if you’re mid-application and read anything new. Decision letters arrive as PDFs in this section.
When the login doesn’t work
Locked accounts unlock automatically after four hours. The Department changed this in 2024 so you no longer have to call support or wait days. If you’re sure of your credentials and you’ve just been locked out, come back later in the day rather than starting a reset.
Forgotten passwords use the “I have forgotten my ImmiAccount username or password” link under the login button. The reset email goes to your registered address within a few minutes. If nothing arrives, check spam, then confirm you’re using the same email tied to the account.
Lost access to the authenticator app uses a separate “I no longer have access to my multi-factor authentication app” link. You’ll need your password and the correct answers to your secret questions, and the system walks you through registering a new device from there.
If none of the above works, the ImmiAccount technical support form is the official channel. Response times tend to run two to five business days. For anything time-sensitive on an active application, raise a status enquiry from inside ImmiAccount itself rather than going through technical support.
If you’re stuck before you’ve even submitted, our step-by-step Australia visa application guide walks through what to set up before you log in, and the transit visa guide covers the simplest application most Singapore travellers will ever lodge through the portal.
Locked out of ImmiAccount or unsure how to import an existing application? Our consultants handle ImmiAccount issues weekly and can help you regain access without losing time on a pending visa.