diff --git a/app/controllers/users/verify_personal_key_controller.rb b/app/controllers/users/verify_personal_key_controller.rb
index 3e2fc320ff4..863c5258668 100644
--- a/app/controllers/users/verify_personal_key_controller.rb
+++ b/app/controllers/users/verify_personal_key_controller.rb
@@ -22,6 +22,7 @@ def new
 
     def create
       if throttle.throttled_else_increment?
+        irs_attempts_api_tracker.personal_key_reactivation_throttled(success: false)
         render_throttled
       else
         result = personal_key_form.submit
@@ -30,6 +31,10 @@ def create
           **result.to_h,
           pii_like_keypaths: [[:errors, :personal_key], [:error_details, :personal_key]],
         )
+        irs_attempts_api_tracker.personal_key_reactivation_submitted(
+          success: result.success?,
+          failure_reason: result.errors,
+        )
         if result.success?
           handle_success(decrypted_pii: personal_key_form.decrypted_pii)
         else
diff --git a/app/services/irs_attempts_api/tracker_events.rb b/app/services/irs_attempts_api/tracker_events.rb
index 3cdf52c8883..629798be9bf 100644
--- a/app/services/irs_attempts_api/tracker_events.rb
+++ b/app/services/irs_attempts_api/tracker_events.rb
@@ -221,6 +221,26 @@ def mfa_login_webauthn_roaming(success:)
       )
     end
 
+    # Tracks when user has entered personal key after forgot password steps
+    # @param [Boolean] success
+    # @param [Hash<Symbol,Array<Symbol>>] failure_reason
+    def personal_key_reactivation_submitted(success:, failure_reason:)
+      track_event(
+        :personal_key_reactivation_submitted,
+        success: success,
+        failure_reason: failure_reason,
+      )
+    end
+
+    # Tracks when User personal key has been throttled by too many attempts
+    # @param [Boolean] success
+    def personal_key_reactivation_throttled(success:)
+      track_event(
+        :personal_key_reactivation_throttled,
+        success: success,
+      )
+    end
+
     # Tracks when user confirms registration email
     # @param [Boolean] success
     # @param [String] email
diff --git a/spec/controllers/users/verify_personal_key_controller_spec.rb b/spec/controllers/users/verify_personal_key_controller_spec.rb
index bf2e56feefb..521a226d97e 100644
--- a/spec/controllers/users/verify_personal_key_controller_spec.rb
+++ b/spec/controllers/users/verify_personal_key_controller_spec.rb
@@ -109,22 +109,49 @@
 
         expect(subject.reactivate_account_session.validated_personal_key?).to eq(true)
       end
+
+      it 'tracks irs attempts api for relevant users' do
+        stub_attempts_tracker
+
+        expect(@irs_attempts_api_tracker).to receive(:track_event).with(
+          :personal_key_reactivation_submitted,
+          failure_reason: {},
+          success: true,
+        ).once
+
+        post :create, params: { personal_key: profiles.first.personal_key }
+
+        expect(subject.reactivate_account_session.validated_personal_key?).to eq(true)
+      end
     end
 
     context 'with an invalid form' do
       let(:bad_key) { 'baaad' }
 
-      before do
+      it 'sets an error in the flash' do
         post :create, params: { personal_key: bad_key }
-      end
 
-      it 'sets an error in the flash' do
         expect(flash[:error]).to eq(error_text)
       end
 
       it 'redirects to form' do
+        post :create, params: { personal_key: bad_key }
         expect(response).to redirect_to(verify_personal_key_url)
       end
+
+      it 'tracks irs attempts api for relevant users' do
+        stub_attempts_tracker
+
+        expect(@irs_attempts_api_tracker).to receive(:track_event).with(
+          :personal_key_reactivation_submitted,
+          failure_reason: personal_key_error,
+          success: false,
+        ).once
+
+        allow_any_instance_of(VerifyPersonalKeyForm).to receive(:submit).and_return(response_bad)
+
+        post :create, params: { personal_key: bad_key }
+      end
     end
 
     context 'with throttle reached' do
@@ -149,6 +176,20 @@
 
         expect(response).to render_template(:throttled)
       end
+
+      it 'tracks irs attempts api for relevant users' do
+        stub_attempts_tracker
+
+        expect(@irs_attempts_api_tracker).to receive(:track_event).with(
+          :personal_key_reactivation_submitted,
+          failure_reason: personal_key_error,
+          success: false,
+        ).once
+
+        allow_any_instance_of(VerifyPersonalKeyForm).to receive(:submit).and_return(response_bad)
+
+        post :create, params: { personal_key: bad_key }
+      end
     end
   end
 end