https://identityassurance.blog.gov.uk/2014/10/10/introducing-the-document-checking-service/

Validating identity information against an authoritative source

This post is an introduction to the document checking service, part of GOV.UK Verify's technical architecture. If you're interested in the different documents and methods certified companies can use to verify you, you can read more in this post.

-----

In previous posts we've explained how identity assurance works; a certified company (also known as an identity provider) will undertake a set of checks to establish to a defined level of confidence that it's really you. To do this, they have to look at a range of evidence and different methods to reach the required level of confidence, so that someone can't easily pretend to be you using just one or two pieces of evidence.

As part of the process of verifying a user's identity, identity providers will ask users to provide evidence that it's really them. This might include providing details of official documents like a passport or driving licence. In the past, to check whether these documents were valid, an identity provider would have had to make a phone call, or physically look at the documents or a copy of them.

We've built the document checking service so that identity providers can check digitally - immediately - to make sure the information provided by the user matches a valid record.

This is an important part of GOV.UK Verify, because it means identity providers can complete all the necessary checks within the time it takes for a user to go through their verification process - about 10 minutes in total, on average. It means people won't have to send things in the post or take their documents to a counter service. Instead, people will be able to verify their identity entirely digitally.

How the document checking service will work

The user will enter their details from their documents in the identity provider’s service. The identity provider will submit these to the document checking service, which will present this information to the document issuer (HM Passport Office or DVLA) for checking.

Once checked, the document checking service will inform the identity provider that the document details are valid or not. A failure might be because the user entered the details incorrectly or the document has been revoked, reported lost or reported stolen. The identity provider can then carry out further verification to see if the person is who they say they are.

Privacy and data protection

We’ve built the document checking service in a way that protects users’ privacy. The Service doesn’t have direct access to any government data - it allows identity providers to receive a yes / no response from the holders of data, telling them whether data asserted by a user matches a valid record.

Identity providers aren’t allowed to re-use the data for any other purpose without the user’s informed consent and they must store the data securely and safely, within the requirements of data protection laws.

The scope of the document checking service

The document checking service will initially link to the DVLA and HM Passport Office, so an identity provider will be able to use it to validate UK issued passports and driving licences from Great Britain. We will be working with other government departments and agencies to expand the range of documents we can allow identity providers to validate.

41 comments

  1. Will Roebuck

    Who will become an identity provider? Is it possible that local community groups might provide a service?

    Link to this comment
    • Janet Hughes

      Hi Will.
      Yes, there's no reason why not. All potential identity providers will have to go through a procurement process where they bid against set criteria to show they are able to provide the required services - we'll be announcing details of how that process will work in the next few weeks.

      Link to this comment
    • bob

      mmm lets talk

      Link to this comment
  2. Jamie Glennon

    Good article though it should be noted that the process described here is for the validation of identity information against an authoritative source and not the full verification process that an identity provider may undertake to verify an individual and resolve it to the person.

    "As part of the process of verifying a user’s identity, identity providers will ask users to provide evidence that it’s really them."

    It isn't possible to verify a person simply through an electronic verification of attributes that are associated with government issued ID. It is however an extremely important part of the full identity verification and resolution process. Ultimately that gets to the point where the person who is claiming who they purport to be is in actual fact them and that the identity attributes being collected is accurate and uniquely distinguishes them. That last part is what this article is about.

    Good stuff. Thank you.

    Jamie Glennon

    Link to this comment
    • Janet Hughes

      Hi Jamie - thanks for commenting, and yes what you say is right, this is just part of the work that an identity provider has to do to verify someone's identity.

      Link to this comment
  3. george

    having a hard time filling in a v317 form

    Link to this comment
    • Rebecca Hales

      Hi George, sorry to hear you're having problems.

      You could try telephoning DVLA Customer Enquiries on 0300 790 6802 and they should be able to help.

      Link to this comment
  4. Mike Pope

    So if I choose not to have a passport, driving licence, mobile phone where does that leave me? Once again it is assumed that everyone has these items. None of them are (yet) compulsory.

    Link to this comment
    • Rebecca Hales

      Hi Mike

      At the moment you need a valid passport or a photocard version of the driving licence, and a mobile telephone.

      We will be increasing the range of official records that certified companies can validate users’ data against, so that those without a driver licence or passport will still be able to verify their identity.

      See this blogpost which explains how we are going to expand the range of data sources that’s used by certified companies: https://identityassurance.blog.gov.uk/2014/12/01/data-sources/

      At least one identity provider is planning to provide an alternative way for people who don’t want to use a mobile phone to receive a code when they authenticate. So if you want to use another method, other than a mobile phone, you’ll be able to choose an identity provider that will enable you to do that.

      Link to this comment
  5. elaine bingham

    How do I apply if I don't have a passport or photo driving licence?

    Link to this comment
    • Rebecca Hales

      Hi Elaine

      GOV.UK Verify is in beta, which means it is constantly being developed and improved based on feedback from people who use it. We’re not able to verify everyone yet using GOV.UK Verify - we’re working to make it possible for people to use other evidence instead of passports and driving licences. (There are other posts on the blog that explain what we’re doing about this, if you’re interested to find out more see: https://identityassurance.blog.gov.uk/tag/improvement/).

      Anyone who doesn’t have those documents, or for some other reason can’t be verified using GOV.UK Verify at this stage, can return to the service you wanted to use and follow the guidance on the other ways that exist for you to access the service.

      Link to this comment
  6. Gulabchand Shah

    It should be sufficient for the user to verify his/her identity by simply providing bank, passport and driving licence details. Asking for any further details is going too far.

    Link to this comment
    • Rebecca Hales

      Hi Gulabchand

      When people use digital services, it's important to be able to trust that it's really them and not someone fraudulently using their identity to access services. A verified identity account with a certified company through GOV.UK Verify provides identity assurance to a high level of assurance, which is required for many transformed government digital services which allow people for the first time the ability to amend records and make claims entirely digitally.

      Certified companies have to work to published government standards when they verify your identity. To do this, they have to look at a range of evidence and checks to establish that you are who you say you are – no single piece of evidence is sufficient.

      Thank you for taking the time to provide feedback. We're working to improve our service, so all feedback is valuable to us.

      Link to this comment
  7. Rizwan

    Hi,

    Can the validity of a foreign passport be checked as well?

    Link to this comment
    • Rebecca Hales

      Thank you for your comment, Rizwan.

      GOV.UK Verify is a new service, currently in beta (trial) and is being constantly developed and improved.

      The document checking service currently works for UK passports and driving licences from Great Britain.

      However, this does not mean that people with international passports can't use GOV.UK Verify. When a user accesses GOV.UK Verify, they are asked what identification documents they have and will be offered the option of certified companies that may still be able to verify them with a non-UK passport.

      We're looking at further ways of extending GOV.UK Verify to accept international passports​ and you can follow our progress here on the blog.

      Link to this comment
  8. Theo Olsthoorn

    Someone who I bought a bicicle from through the internet (Quoka.de), sent me a copy of his UK passport as evidence that he could be trusted. I paid, but never got the bicible. Can I let this passport copy be verified to see whether the person really exists, and if so, where and how an I do that?

    Link to this comment
    • Janet Hughes

      Hello Theo

      I'm afraid that's not a service we provide, no. We do enable GOV.UK Verify certified companies to check the validity of passport details provided by users against HM Passport Office's database, only for the purposes of validating passport details as part of the range of checks they have to carry out to verify the person's identity for GOV.UK Verify (see: https://identityassurance.blog.gov.uk/2014/11/21/how-does-a-certified-company-establish-that-its-really-you/).

      GOV.UK Verify is only in use for people accessing central government services (not services in the wider public sector or private transactions).

      You could put your question directly to HM Passport Office, as they are responsible for passports and may be able to help you: https://www.gov.uk/passport-advice-line.

      Link to this comment
  9. Terry Milton

    I have been sent a photot of a UK passport I am sure is fake, all I want is to know fake or real but it sounds like you can't help with anything so simple?

    Link to this comment
  10. Meike

    Hi!
    I need to verify my identity for filing a UK Tax Return. The information I couldn't find is how I can verify my identity with a foreign passport. My search took me to this site so I thought I'd leave a comment in the hope of getting information.

    Link to this comment
    • Rebecca Hales

      Hi Meike

      Thank you for trying GOV.UK Verify. It is a new service, currently in beta (trial) and is being constantly developed and improved based on . GOV.UK Verify may still be able to verify you. If you return to GOV.UK Verify, you will be asked what identification documents you have and will be offered the option of certified companies that may be able to verify you with a non-UK passport.

      Link to this comment
  11. Johnatha

    Hello,

    I applied for a provisional driving licence. I supplied my passport number and gave permission for the DVLA to use the photo and signature, but did not have my National Insurance Number at hand to supply. They said they will send a form validation checks. Is this the sort of checks they will be doing?
    What else will they ask in the form if they already have my passport details?

    Link to this comment
    • Rebecca Hales

      Hi there

      GOV.UK Verify isn't connected to DVLA's Apply for your first provisional licence service so, no, they won't be conducting this check.

      You can find information about what kind of ID documents you'll need to provide here: https://www.gov.uk/id-for-driving-licence

      Link to this comment
  12. Hayln Heir

    Is there a number I can quickly call to find out if I am using the correct passport?

    Link to this comment
    • Rebecca Hales

      Hi Hayln

      We don't have a number for you, I'm afraid. However, to use your passport to access a service via GOV.UK Verify it just needs to be valid (in date, not an expired passport) and reflect the name associated with the identity that you are trying to assert.

      Link to this comment
  13. mark

    Why has my previous comment been removed!!!

    Link to this comment
    • Rebecca Hales

      Hi Mark

      Thanks for getting in touch.

      We don't generally publish user support requests here on the blog as they often contain personal details. For that reason we have responded to your earlier comment via email.

      Link to this comment
  14. Patel

    Hi,
    I am stuck in the 2 step verification.
    I have an Indian passport, no drivers license. The verification process by certified companies ask for driver license since I hold a Indian passport. Now i am stuck and unable to do anything.i am on a work visa for 12 months ..please help.
    I want to skip it to the next step and file my returns.

    Link to this comment
    • Rebecca Hales

      Hi there,

      I'm sorry that you experienced issues using GOV.UK Verify.

      GOV.UK Verify is being constantly improved and developed based on user feedback but we're not able to verify everyone yet.

      There will continue to be other ways for people to access services if we’re not able to verify their identity through GOV.UK Verify. If you haven't already, then please do return to the service you wanted to use and follow the guidance on the other ways that exist for you to access the service.

      Link to this comment
      • christine harmer

        Hi I have tried repeatedly to access hmrc to complete my tax return and are imputing my passport details correctly but it keeps telling me details do not match, I know I am doing it right as my partner did his exactly the same way and it was fine. Please help!

        Link to this comment
        • Emily Ch'ng

          Hi there,

          I’m sorry you’re experiencing difficulties.

          If you have a UK passport, please contact the passport office, and speak to them regarding your passport details and explain that the GOV.UK Verify system was unable to match it. They may be able to provide insight as to why this is. We are unable to check with them on your behalf due to data protection issues.

          Their telephone number is 0300 222 0000, or you can contact them online via https://eforms.homeoffice.gov.uk/outreach/Passport_Enquiries.ofml

          Link to this comment
  15. Lisa

    My daughter has just applied for a first prov licence giving full details of passport etc yet still they want to validate via post what is this about please ?

    Link to this comment
    • Emily Ch'ng

      Hi Lisa

      Currently the only DVLA service connected with GOV.UK Verify is 'View or share your driving licence information'. So the best place for you to enquire about your daughter applying for a provisional licence would be by contacting DVLA directly.

      Their contact details are 0300 790 6801 (lines are open Monday to Friday, 8am to 7pm and Saturday, 8am to 2pm). There is also a form you can fill in on this page: https://www.gov.uk/contact-the-dvla

      Link to this comment
  16. Nick

    I have just received a new "Beta" service passport.
    Do I sign it above the line that says "Holders Signature/Signature du titulaire" (as per a normal document) or in the space below the line (as is the convention for the scanned signature on the following page for non-beta passports)?

    Link to this comment
    • Emily Ch'ng

      Dear Nick

      For passport queries you could try contacting the passport advice line for help: https://www.gov.uk/passport-advice-line

      On this page there is an online enquiry form you could fill in for general advice, or you could phone them on: 0300 222 0000.

      Thanks,

      Emily

      Link to this comment
  17. Ugs

    Hi,

    I'm looking for an Email address\contact to send my global tax form to (verification as a UK tax payer required), as the law has now changed in the past couple of years in regards to taxation, which now requires all documentation to be supported with a HMRC stamp and signature.

    Any help would be greatly appreciated....many thanks!

    Link to this comment
  18. James

    I have been conversing with a person on line that i have not met in person. She is English. She has got into a difficult situation monetarily in another country and can't get home to Australia, where she now resides. Because there are so many scams happening I asked her for a copy of her passport. Can I get it confirmed that the passport is a legitimate one? Or that the photo belongs with this passport?

    Link to this comment
    • Emily Ch'ng

      Hello,

      You've come through to the blog of GOV.UK Verify - the new way for citizens to verify their identities online to access government digital services. So I'm afraid I'm not able to answer your query about passport validation. However, you'd might like to get in touch with the passport advice line: https://www.gov.uk/passport-advice-line

      Link to this comment
  19. Paul Chambers

    Thanks for blog and could i ask what happens if my identity is stolen and documents like passport are in the possession of another person who intends to commit fraud. From what i understand as no physical check is required they could then provide details sufficient to satisfy the verify checks and receive a government id that could be used to assist their fraudulent activity. Are there any government indemnities or warranties behind this scheme if the verify online identity results in fraud or monetary loss to me as a result?

    Link to this comment
    • Emily Ch'ng

      Hi Paul

      Thanks for your query

      GOV.UK Verify currently provides identity assurance at level of assurance 2, which means that on the balance of probability the user is who they say they are. See this blogpost for an explanation of what’s involved when a certified company verifies someone’s identity for the first time: https://identityassurance.blog.gov.uk/2014/11/21/how-does-a-certified-company-establish-that-its-really-you/

      Certified companies have to work to published government standards when they verify your identity. To do this, they have to look at a range of evidence and checks to establish that you are who you say you are – no single piece of evidence is sufficient. So, for example, a fraudster holding a person’s passport would not be sufficient evidence for them to use to access someone’s identity through GOV.UK Verify.

      To achieve the required level of assurance, the certified company has to validate evidence across a range of categories, check that your identity has been active over time, and check counter-fraud records. For example, to verify that you are who you say you are, one commonly used method involves asking the person a range of questions it’s likely only they would know the answer to (also known as knowledge based verification).

      The standards are about managing risk - there is no solution (offline or digital) that provides a 100% guarantee that a user is who they say they are.

      A certified company is liable in the same way as any other data controller if it's hacked and personal data is compromised.

      If a certified company fails to comply with the published government standards for identity assurance and, as a result of this breach of contractual obligations, asserts a verified identity relating to someone who is not the user, the certified company is responsible for the losses.

      Certified companies are also responsible if someone who is not the user is wrongly granted access their verified identity account because the certified company has failed to comply with the published government standards.

      If a certified company has complied with the government standards for identity assurance, meeting all contractual obligations, but a user is still successful in creating a fraudulent verified identity account, the certified company is not liable.

      The government standards are constantly under review and we update them regularly to make sure they reflect the evolving and changing nature by which people look to undertake their criminal behaviour. In the event of fraudulent activity occurring despite all contractual requirements being met by a certified company, we would work with the government service and with law enforcement partners to iterate the standards to protect against further threats to the delivery of online services in future.

      Link to this comment