This guidance will help you decide how to check someones identity. Some existing identity checking services already follow this guidance.
This guidance was written by Government Digital Service (GDS) with help from organisations across the public and private sectors. Key contributors include:
Department for Work and Pensions (DWP)
Driver and Vehicle Licensing Agency (DVLA)
HM Revenue and Customs (HMRC)
Home Office
Ministry of Defence (MoD)
National Cyber Security Centre (NCSC)
Barclays
Digidentity
Experian
IDEMIA
Post Office
This guidance aligns with these international standards and regulations:
This guidance does not explain the practical ways you can check someones identity. Youll need to decide what tools or processes you want to use based on whats appropriate for your service. For example, you might decide to accept a passport as evidence of someones identity if you know:
the users of your service are likely to have a passport
staff in your organisation have equipment they need to check the document effectively
Updates to this page
Published 6 January 2014 Last updated 14 November 2024 +show all updates
The section Check that the identity belongs to the person whos claiming it has small updates for score 2 and score 3. There are new requirements for testing systems or laboratories used for biometric matching and thestandards that should be applied.
Added a new section on: Why you should not accept a National Insurance number as proof of identity
Updated How to prove and verify someone's identity. Added a section on how to check expired identity evidence or evidence that does not have an expiry date under Check the evidence is genuine or valid.
Removed line about using GOV.UK Verify to prove users' identities. This is because GOV.UK Verify is closing.
Expanded the list of types of organisations that run specialist training in how to examine identity evidence.
The 'Check if the claimed identity is at high risk of identity fraud' and 'Check that the identity belongs to the person whos claiming it' sections have been updated. They now include more guidance about what extra checks you can do if you find a claimed identity that's at high risk of identity fraud or suspected to be a synthetic identity.
The guidance has been split into 2 parts. The identity profiles are now separate from the rest of the guidance to make it easier for users to find the profile they need.New identity profiles have been added to give users more choice in how they combine the different parts of the identity checking process. Some of the 'very high' profiles have been removed as very few organisations or services would actually need that much confidence in someone's identity.The way 'activity' checks are scored has changed. There's no longer a requirement to know if the type of interactions are typical of that person. These checks are also now called 'activity history' checks.Different quality knowledge-based verification (KBV) challenges can now be combined to get a score of 2 for 'verification'. This means there are more ways to use KBV to link a person to a claimed identity.
The guidance has been given a more active title.The 'Get evidence of the claimed identity' section now includes some information about what to do if a piece of evidence contains transposition errors.The 'Check the evidence is genuine or valid' section now explains that digital evidence will always get at least a score of 2. In the same section, the requirements needed for evidence that contains digital information have been updated to take into account things like information found in databases.The guidance about identity profiles has been updated to clarify that you do not need to add up the individual scores within a profile to come up with a total.
The definition of valid has been updated in the 'Check the evidence is genuine or valid' section. Checking a piece of evidence has not expired, cancelled or been reported as lost or stolen used to be things you could do as part of the 'valid' check. These are now listed as separate checks. It's now clearer that you do not need to check if a piece of evidence has been cancelled, lost or stolen to get a score of 2 or 3.
The guidance has been rewritten in plain English so it's easy for both technical and non-technical users to understand.The annexes from the previous version have been removed and the information from them added to the guidance.Examples of how checks can be done have been added throughout the guidance.Information about checking someone's biometric information has been added to the 'Check that the identity belongs to the person whos claiming it (verification)' section.The 'Identity profiles' section has been expanded. The new identity profiles will make it easier to check the identities of users who do not have much evidence of their identity.
