Can Two People Use One IRCTC Agent ID or Login?

It’s lunchtime, the queue is out the door, and your helper is standing right next to you. You’re logged in. It would take two seconds to turn the screen around and let them book the next ticket. At a cyber cafe or multi-service counter, one login is very easy to pass around.

Before you do it, read what IRCTC’s own documents say about it, what sharing can cost, and what to ask your provider in writing. The short rule is already on the registration page. The sources behind it are here.

What do IRCTC’s documents say about sharing an agent ID?

These documents cover the Internet Cafe and B2B schemes. If your provider isn’t on those schemes, ask which IRCTC document governs your ID. In them, the agent is called a Retail Service Provider (RSP), and the provider that registered the agent is the Principal Service Provider (PSP). As of 17 October 2026, all of them are public on IRCTC’s content site. The wordings below are quoted, not summarised.

The Revised Agent Policy, effective 29 November 2019, explains why each agent registers a digital certificate and a machine ID: it is “essential to prevent sharing of IDs”. That shows how much weight IRCTC puts on it. None of these documents sets out a second-user option.

What does “one authorised user” mean for the DSC?

The “one authorised user” sentence sits inside a rule about Class 3 digital signature certificates (DSC). Item 3 of the Norms for Internet Cafe Scheme reads: “All such centers will be required to purchase a class 3 personal digital certificate from any Indian Certifying Authority for their authorized user (only one authorized user will be permitted).” Item 1 describes the centres as the “Outlets/Agencies/Centres” of a provider’s Internet Cafe agents. Exactly who “such centers” covers is for IRCTC to say. So we quote the sentence and leave the reading to IRCTC.

IRCTC’s documents differ by date on the DSC itself. A retail agent can log in with OTP, or with a Class 3 DSC if they hold one (IRCTC integration policy, effective 2 September 2020). IRCTC’s earlier agent policy (29 November 2019) described the agent’s DSC as mandatory to register. Its Norms for Internet Cafe Scheme (PDF created 14 June 2021) say the centres will be required to buy a Class 3 personal digital certificate for their authorised user, with only one authorised user permitted. Which login options apply to your ID: being confirmed against IRCTC’s current rules.

Why do counters share a login, and what can it cost?

The reasons are ordinary. A shift changes at noon. The owner steps out for an hour. A second person could clear the queue if only they could sign in. None of these reasons appears in IRCTC’s documents as an exception.

The cost sits in IRCTC’s penalty table. As of 17 October 2026, the rules document lists “Sharing of Access credentials” under software tampering. It lists “Sharing of access credentials to web services” and “Sharing of RSP ID” under unauthorised access. It doesn’t say whether “access credentials to web services” covers an agent’s own login. The two penalties are:

• Unauthorised access: ₹20,000 plus taxes per case on the PSP, and the RSP ID of that outlet is “permanently deactivated”. Cases involving cyber act violations are reported to the Cyber Crime Police and the Railway Protection Force.
• Software tampering: the same document lists “Sharing of Access credentials” among cases that carry ₹25 lakh plus taxes per case on the PSP, with the PSP’s services suspended for three months.

Look at that again. Two headings, very different penalties, overlapping words, and the document doesn’t explain the overlap. So don’t assume the lower one applies to you.

For you as the agent, the practical loss is the ID itself. A permanently deactivated ID ends IRCTC booking from that counter on that ID. For irregularities by an agent, the document says action is taken against the PSP “in addition to whatever action” is taken against the agent. Whether a provider may recover a penalty from the agent isn’t covered anywhere in it. So read your own agreement, or ask in writing.

Why does the OTP matter?

Under the 2 September 2020 integration policy, the agent’s registered mobile is the one booking route, and the provider is responsible for making sure the agent books “from the registered location”.

Think about what that means at the counter. A second person at the screen can only finish a login if the OTP reaches them. For that to happen, either the owner’s phone gets handed over or the OTP gets read out loud. IRCTC words the prohibitions as “Sharing of access credentials to web services” and “Transfer/Sharing of RSP ID”, and it doesn’t say in those exact words that an OTP counts. We don’t offer a way around that, and neither should anyone else. Ask your provider.

If your ID logs in with a DSC token instead of an OTP, the documents don’t say how the sharing rule applies to the token and its password.

The rules document asks each registration for a “Unique Mobile No. and Unique e-mail id & PAN No.” and says “Request for additional registrations will be considered at the discretion of the competent authority.” It’s written for providers and doesn’t describe staff IDs. Whether a provider can register a second ID at one address, with a second person’s own details, is a question for the provider. These PDFs also don’t settle how the Device ID and registered-location wording applies to your ID today, so ask in writing which parts apply now.

What should you ask your provider in writing?

Send these by email or WhatsApp, and keep the reply:

1. Under IRCTC’s current rules, is there any way for a second person to book for customers from my counter? If yes, which document says so?
2. May I register a second agent ID at the same address for a staff member, with that person’s own PAN, mobile number and email?
3. Which login type applies to my ID, and what does the provider say about the “one authorised user” wording?
4. If the ID holder is unavailable for a few days, what is the provider’s process for my counter?
5. If a penalty is recorded against my ID, how does the agreement treat it?

Never ask a provider for a way to share a password, and never accept one. If a provider offers to “add a staff login” to your ID, ask which IRCTC document permits it and get the answer in writing. A verbal “yes, it’s fine” won’t help you if a penalty lands.

Which counter work doesn’t need the login?

Some of the work doesn’t need the login at all. The rules document asks the agent to keep the customer’s written or electronic request and a copy of the customer’s ID proof, and to show the passenger’s mobile number correctly on the Electronic Reservation Slip (ERS). A colleague could prepare those at the front desk while the agent books. The documents don’t describe staff roles either way, so check with your provider that this split is acceptable for your ID before you rely on it.

At the end of a shift, the ID holder signs out and keeps the OTP phone. If the holder is away, ask your provider in writing what’s allowed before anyone else signs in on that ID.

What if a staff member who knew the login leaves?

Treat the credentials as exposed if the person ever knew the password or held the OTP phone. Tell your provider the date the person left. IRCTC’s documents give no steps for this, so what happens next is the provider’s to say.

If your ID is through SiOnline, contact SiOnline support on +91 91091 35959, 24 hours, 7 days, and give your agent ID. Never send a password or an OTP. Ask what steps apply to your ID, including a change of the registered mobile number. The guide to changing the OTP mobile number covers that change for agent IDs.

Keep a note of the date the person left and the date you took each step. If IRCTC or your provider asks about a booking later, those dates matter.

Questions agents ask

Can my staff log in to my IRCTC agent ID? IRCTC’s documents prohibit sharing access credentials, and the Norms for Internet Cafe Scheme say “only one authorized user will be permitted” in a certificate rule. They describe no staff login. Ask your provider in writing before trying any arrangement, and don’t give anyone the password or the OTP.

Can I register a second agent ID for an employee? IRCTC’s rules document asks for a unique mobile number, email and PAN for each registration. It doesn’t say whether a second ID at the same address is allowed. That’s a question for your provider, in writing.

Where does the OTP go when I log in? To the registered mobile number of the agent, on every login, according to IRCTC’s rules document. Keep that phone with the ID holder.

What happens if an agent ID is found shared? As of 17 October 2026, the penalty table lists ₹20,000 plus taxes per case on the PSP and permanent deactivation of the outlet’s ID under unauthorised access, and a higher penalty under software tampering. Read your own agreement.

Sources

• IRCTC, Rules & Regulations for Reserved Rail e-Ticketing Service Providers, PDF created 20 November 2020, retrieved 17 October 2026.
• IRCTC, Revised Agent Policy, effective 29 November 2019, retrieved 17 October 2026.
• IRCTC, Policy for Integration of B2B & Internet Cafe PSPs, 2020, effective 2 September 2020, retrieved 17 October 2026.
• IRCTC, Norms for Internet Cafe Scheme, PDF created 14 June 2021, retrieved 17 October 2026.

Facts on this page were last checked on 17 October 2026. Rules and penalties change, so confirm them at the source before you act. To see how to verify a provider, read the PSP list page.