Updated
Since October 24, 2026, the IHSS Electronic Services Portal (ESP) — the website at etimesheets.ihss.ca.gov where providers submit timesheets and recipients approve them — has been moving to a new way of confirming who you are: a One-Time Passcode (OTP). Once your current password expires, you’ll sign in with a short-lived code sent by email, text, or automated phone call instead.
The California Department of Social Services (CDSS) emailed ESP users about the change on October 14. Here is how sign-in works now, what to do if a code doesn’t arrive or your account locks, why it’s safer, and the one thing worth checking today.
At a glance
- StartedOctober 24, 2026, in phases. You switch over once your password expires.
- Who it affectsIHSS providers and recipients who use the ESP or the EVV Mobile App
- What changesYou sign in with a one-time code instead of your password
- How you get the codeEmail, text, or automated phone call
- Code lasts10 minutes, one use only
- Watch out5 wrong entries, or more than 3 code requests, temporarily locks your account
- Do nowCheck your contact info on file
What is changing
- A code instead of a password, once your password expires. Each passcode works once and expires 10 minutes after it is sent.
- You choose how to receive it: email, text message, or an automated voice call. Which options you see depends on the contact information your county IHSS office has on file for you.
- It also covers the EVV Mobile App. Signing in to the Electronic Visit Verification (EVV) Mobile App will use a passcode too.
- It rolls out in phases. The ESP login page says the switch happens once your password expires, so you may not see it right away.
Still seeing the old sign-in screen? That’s expected.
The ESP login page says you’ll switch to a passcode once your password expires, so people move over at different times. Nothing is wrong with your account if you haven’t been asked for a code yet.
The CDSS notice does not mention any change to the Telephone Timesheet System (TTS), the phone-based option for timesheets.
When you will need a passcode
According to CDSS, you will be asked for a One-Time Passcode when:
- Logging inEvery time you sign in to the ESP
- EVV Mobile AppSigning in to the Electronic Visit Verification app
- First-time registrationCreating a new ESP account
- Password expired or resetWhen your password runs out or you choose to reset it
- Contact informationUpdating your phone or email on file
- Direct DepositSetting up where your pay goes
- Email changeChanging your email with the IHSS Service Desk
- eHireWhen a recipient assigns a provider
How signing in will work
- Go to etimesheets.ihss.ca.gov, enter your ESP username, and select Continue.
- You will see the ESP One-Time Passcode Login.
- Choose how to receive your passcode: Email, Text, or Phone Call.
- Select Continue.
- Enter the passcode you received and select Login.
If your passcode does not arrive
- Wait a few minutes. If you chose email, check your spam folder as well as your inbox.
- Still nothing? Select Resend Passcode to get a new one. Keep the lockout rule below in mind before you resend more than once.
- Check your phone or email right after you request a code. The 10-minute clock starts when the code is sent, not when you open it.
If your account locks
The Service Desk can help with a locked account. If you can’t get into your account and the email or phone number on file is wrong, CDSS says to contact your county IHSS office instead.
Too many tries will lock your account
CDSS says your ESP account will be temporarily locked if you enter your passcode incorrectly 5 times, or if you request more than 3 passcodes.
Ask for one code, then give it a few minutes and check your spam folder before you select Resend. If you do get locked out, call the IHSS Service Desk at (866) 376-7066.
Why this is safer
- Sign in to ESP and open the Contact Information screen. Confirm your email and phone number are current and are ones you can actually reach on the day you need them.
- Fix anything wrong before a timesheet is due. CDSS says new contact information cannot be used to receive a passcode for 24 hours after a change unless additional verification is completed.
- Know which change goes where. You can edit your phone number in ESP after verifying with a passcode. To change your email address, call the IHSS Service Desk at (866) 376-7066. If you can’t get into your account and your contact information is wrong, contact your county IHSS office.
- Pick a method you can count on. If texting is difficult for you, the automated phone call option may be easier. If you share a phone, consider which method keeps the code private.
Check these now
- ✓Check your Contact Information screenSign in to ESP and confirm your email and phone are current and ones you can reach.
- ✓Fix anything wrong before a timesheet is dueNew contact info cannot receive a passcode for 24 hours after a change unless extra verification is completed.
- ✓Know who changes whatPhone: edit in ESP after a passcode. Email: call the IHSS Service Desk. Can’t get in and your contact info is wrong: your county IHSS office.
- ✓Pick a method you can count onIf texting is hard, the automated phone call may be easier. If you share a phone, choose the method that keeps the code private.
A stolen password is no longer enough
With a password, anyone who learns it — from a data breach, a reused password, or a note left by the computer — can sign in. CDSS says that under the new system, even someone who knows your old password still cannot sign in without the passcode sent to you.
The code is useless almost immediately
Each passcode works one time and expires in 10 minutes. A code someone overhears or sees later cannot be reused to get back in.
It guards the actions that matter most
Look at what CDSS put behind a passcode: Direct Deposit, contact information, email changes, and eHire provider assignments. Those are the settings someone would need to change to redirect a provider’s pay or interfere with who is on a recipient’s case. Requiring a fresh code for each of those changes protects both people in the caregiving relationship — the provider’s paycheck and the recipient’s care team.
Your account is now only as secure as your email and phone.
The federal Cybersecurity and Infrastructure Security Agency (CISA) notes that codes sent by text, voice call, or email can be stolen through scams or through “SIM swap” fraud, where a criminal talks a phone carrier into moving your number to their device. Use a strong password on your email account and add a PIN to your mobile phone account if your carrier offers one.
Helping someone else with their account? Ask now.
The CDSS notice does not explain how this works for people who help someone else manage their account — for example, a parent of a minor recipient, or a family member who helps a recipient approve timesheets.
The code goes to the contact information on file for that account, and CDSS says not to share it with anyone. Ask your county IHSS office or the IHSS Service Desk how they want it handled, rather than finding out when a timesheet is due.
Protect your code: what a scam looks like
A passcode only works if you are the only one who sees it. Scammers know this, so expect them to try to get it from you.
- Anyone who asks for your code is a scammer. That is the FTC’s rule, and CDSS says not to share your passcode with anyone.
- You only get a code when you ask for one. Got one you did not request? CDSS says ignore it, delete it, and do not click suspicious links.
- Go to the site yourself. Type www.etimesheets.ihss.ca.gov instead of tapping a link in a text or email.
- Someone calls asking for a code? Hang up. Worried about your account? Call the IHSS Service Desk at (866) 376-7066 — a number you looked up, not one a caller gave you.
Where to get help
Where to get help
- IHSS Service Desk(866) 376-7066 — Mon–Fri, 8 a.m.–5 p.m., except holidays. Passcode questions and locked accounts.
- Can’t get in and your contact info is wrongContact your county IHSS office
- Step-by-step guideCDSS One-Time Passcode Guide (PDF). Translations are posted on the CDSS ESP help page.
- Free live webinarsCDSS runs ESP training webinars with live Q&A. Check the schedule for upcoming dates.
Never share your passcode. IHSS Connect will never ask for it, and neither will state or county staff.
Need a caregiver? Find one on IHSS Connect for free
Whether you are hiring your first provider, replacing someone, or need backup coverage, IHSS Connect is a free caregiver registry and job board for IHSS recipients and families anywhere in California. You can search for caregivers in your area or post a job so providers can find you.
Start your search at ihssconnect.com.
Hiring your first provider, replacing someone, or need backup coverage? Search caregivers in your area or post a job so providers can find you — anywhere in California.
Sources
- CDSS One-Time Passcode notice (Oct. 14, 2026), via the CDSS ESP help pageWhen a passcode is required, delivery options, 10-minute expiry, EVV app coverage, who changes phone vs. email
- CDSS — ESP One-Time Passcode Guide (PDF)Enrollment and login steps, lockout after 5 wrong entries or more than 3 requests, 24-hour wait after a contact change, county office when locked out with wrong contact info
- IHSS Electronic Services Portal — login pagePasscode required once your password expires; staff never ask for your username or password
- County of Los Angeles DPSS — IHSS Timesheets/EVVOctober 24, 2026 sign-in notice (corroborates password-expiry timing)
- CDSS ESP Training Webinars scheduleWebinar schedule
- FTC: What’s a verification code and why would someone ask me for it?Anyone asking for your code is a scammer
- CISA: Implementing Phishing-Resistant MFA (Oct. 2022)Risks of text, voice, and email codes, including SIM swaps
CDSS is the primary authority throughout. If your screen, your county, or the Service Desk tells you something different, follow their instructions — the system is rolling out in phases and details may change.
