This post is an introduction to the document checking service, part of GOV.UK Verify's technical architecture. If you're interested in the different documents and methods certified companies can use to verify you, you can read more in this post.
In previous posts we've explained how identity assurance works; a certified company (also known as an identity provider) will undertake a set of checks to establish to a defined level of confidence that it's really you. To do this, they have to look at a range of evidence and different methods to reach the required level of confidence, so that someone can't easily pretend to be you using just one or two pieces of evidence.
As part of the process of verifying a user's identity, identity providers will ask users to provide evidence that it's really them. This might include providing details of official documents like a passport or driving licence. In the past, to check whether these documents were valid, an identity provider would have had to make a phone call, or physically look at the documents or a copy of them.
We've built the document checking service so that identity providers can check digitally - immediately - to make sure the information provided by the user matches a valid record.
This is an important part of GOV.UK Verify, because it means identity providers can complete all the necessary checks within the time it takes for a user to go through their verification process - about 10 minutes in total, on average. It means people won't have to send things in the post or take their documents to a counter service. Instead, people will be able to verify their identity entirely digitally.
How the document checking service will work
The user will enter their details from their documents in the identity provider’s service. The identity provider will submit these to the document checking service, which will present this information to the document issuer (HM Passport Office or DVLA) for checking.
Once checked, the document checking service will inform the identity provider that the document details are valid or not. A failure might be because the user entered the details incorrectly or the document has been revoked, reported lost or reported stolen. The identity provider can then carry out further verification to see if the person is who they say they are.
Privacy and data protection
We’ve built the document checking service in a way that protects users’ privacy. The Service doesn’t have direct access to any government data - it allows identity providers to receive a yes / no response from the holders of data, telling them whether data asserted by a user matches a valid record.
Identity providers aren’t allowed to re-use the data for any other purpose without the user’s informed consent and they must store the data securely and safely, within the requirements of data protection laws.
The scope of the document checking service
The document checking service will initially link to the DVLA and HM Passport Office, so an identity provider will be able to use it to validate UK issued passports and driving licences from Great Britain. We will be working with other government departments and agencies to expand the range of documents we can allow identity providers to validate.