How the government plans to 'verify' your identity online

The government is now more than three quarters of the way through its two-year project to make 25 of the most-used government services ‘digital by default’, but until now there has been a major constraint on the government's ability to make public services fully digital – the lack of a reliable method for verifying a person's idenitity over the web.

This means that, although you can apply for a new passport online, you still have to print off the application form and return it to the Passport Office with supporting documents; although you can view your driving records online, you cannot change the address on your driving licence without presenting your passport and proof of address to the DVLA; and although you can register to vote online, you can't actually vote without walking to a polling station or sending a ballot paper in the post.

However, in the next few weeks the Government Digital Service (GDS), (the unit of the Cabinet Office responsible for the government's digital transformation), will begin rolling out a new way for people to verify their identity when interacting with government digital services.

Known as GOV.UK Verify, the tool will allow users to select and register with an identity provider, and then use their 'assured' identity to access digital services. At launch, users will be able to choose between two identity providers – Experian and Verizon. By the end of the year, Digidentity and the Post Office will also be included in the list.

To register with an identity provider a user must provide their name, gender, address and date of birth. They will also need to provide at least two pieces of evidence that demonstrate they are the person they say they are, such as driving licence or bank account details.

The identity provider will then perform a series background checks to verify that the person is who they say they are. These checks may vary depending on the level of assurance the service requires, but could include counter-fraud checks and activity history.

"The identity providers need to make sure that it's really you. The main way they do that is by checking credit reference agency files to see if you are a real, active person. If you're under 19 you're less likely to have a credit record with enough information to prove that, so we’re open in saying that if you're under 19 this might not initially work for you," said Janet Hughes, head of policy and engagement for the identity assurance programme at GDS.

"But we’re rolling this out gradually, and over time we're going to expand the range of ways that the providers can validate that you're real – like mobile network operators – so we’ll cover more people. There will also be other ways for people who aren't able to verify their identity digitally using GOV.UK Verify to access services."

All of the identity providers have been certified to verify the user's identity to a defined level of assurance to meet published government standards. Any information stored by the identity provider has to be stored securely and handled in accordance with data protection law, and the provider is not allowed to use data you provide for any other purpose without your informed consent.

The whole process should not take more than 10 minutes, and once a user has successfully registered with an identity provider they can log into any government service using a simple two-factor authentication process. This means they will have to enter a user name and password, and then they will be sent a code to their mobile phone or landline which they will also have to type into the website.

GOV.UK Verify has been in private beta since February 2014 with HMRC’s PAYE for employees service, DVLA’s View Driving Licence service and Defra’s CAP Information Service. All of these will move into public beta in the coming weeks, meaning the Verify tool will be available to anyone using these services.

GDS hopes that in the future there could be private sector applications for its identity verification platform. It claims that banks are interested in using it to allow customers to set up accounts without going into a branch, and mobile operators could use it to cut down on the number of people setting up contracts using fraudulent identitites.

"Speed, security and only having to do it once are the things that users most care about from our research. The idea is over time we'll start with just one service and then we'll add more and more, and over time this will become a normal way for you to access a whole range of government services, when they need to know you are who you say you are," said Ms Hughes.