Impossible extra security checks with government Gateway doing SA

[JohnB]

I'm sure Mum could remember when she last applied for credit, it was Coronation Year. She could even get a free passport, as part of the Greatest Generation, but at the moment she is invisible to HMRC. I have an ongoing formal complaint, only they are a week overdue in contacting me.

[XFool]

In the long term you will need to find a way of getting through the gateway security so if you do a paper return to get through this year you will still need at some stage to get her identity authenticated.

Why? I have been doing only paper returns for decades with no issue.

I have had no need to use their online system, have an online account, use a "gateway" nor have I needed to furnish any identification.

Obviously you do! I doubt if HMRC would accept, or could elicit, an anonymous tax return.

[XFool]

I'm still trying to get to the bottom of this.

This extra verification was brought in several years ago so I'm surprised there are any accounts where it's just being applied now. I noted the issue back in January 2017 but I'm aware it was introduced in 2016 (but not made immediately mandatory).

Yet I have never heard of, or seen any sign of, it until this thread. There must be more to this than meets the eye.

From that HMRC forum link, here are comments by two separate users:

"Why on earth can't the Government Gateway login page point out that the system has changed and that you need to get yourself a Gov UK Verify access now if you are a non-UK passport holder?"

"The other good thing now being registered with Gov.uk verify, is that she can now access her National Insurance records which were always not accessible with Government Gateway for non UK passport holders."

Could the "non-UK passport holder" (or questions of non residency) have any relevance to these extra security matters?

Looking online generally has turned up no description of such changes, apart from the introduction of the already standard phone PIN.

I tried to login in to the Government Gateway to do Mum's self assessment tax return, as I have the last few years.

I share your feelings about the government gateway. I had many problems getting through the awful authentication questions (credit ref agency questions) with/on behalf of my GF to get her pension forecast.
see: viewtopic.php?f=17&t=27035

From the referenced thread, this appeared to be an online registration issue, rather than simple login.

I'm still baffled...

[Dod101]

I am not sure what this is all about. I remember trying to verify myself via the Post Office or something and could get nowhere. Three or four years ago, I eventually got myself recognised and now as long as I have my user ID number and my password I can activate things and they send me a code to my mobile.

Dod

[Lootman]

Why? I have been doing only paper returns for decades with no issue.

I have had no need to use their online system, have an online account, use a "gateway" nor have I needed to furnish any identification.

Obviously you do! I doubt if HMRC would accept, or could elicit, an anonymous tax return.

Again, I have never been asked to submit identification. I furnish personal details on my tax return, obviously. But they are accepted at face value, along with my cheque of course.

If someone were to complete a tax return on my behalf, get all the details 100% correct, accurately forge my signature, and send a cheque that did not bounce, then I feel sure that would be sufficient for the tax man.

[XFool]

I am not sure what this is all about. I remember trying to verify myself via the Post Office or something and could get nowhere. Three or four years ago, I eventually got myself recognised and now as long as I have my user ID number and my password I can activate things and they send me a code to my mobile.

"Post Office" - So you initially registered online using GOV.UK Verify and now the HMRC login process is exactly the same as it is for me.

When the Personal Digital Account first started it was only possible to register via GOV.UK Verify. I tried and was unable to use it. At the time Verify was intended to be the government's Great New Project for digital online verification for Tax, Benefits etc. I understand it quickly ran into problems. (I have commented on this previously, possibly on TLF.) Some months later, I think it was PinkDalek on the old Motley Fool, who drew people's attention to the then new possibility of logging on using Government Gateway (GG) credentials. I tried, it worked, I have used it ever since.

I had an existing GG account from years before, from the days when you could log in, download a BR19 PDF, print it out, fill it in and post it off to the DWP for a State Pension forecast. This must have been around the time of the Toby Blair government. This later advanced to cutting out BR19 and getting a direct forecast online!

Originally, to register for GG, you applied online, they sent you a long, one-time temporary password by post, you used this online and set up your own password and Bob's your uncle. I had no need for online GG services for years after my SP forecast settled (following the change, at the time, to 30 years NI records for everyone). Never used it again until, years later I saw the post by PinkDalek. The only real change to login since then has been the introduction of the phone PIN.

I do remember some extra verification was needed at some point - NI number, details from last P60 form. But that was only for initially registering phone numbers when phone PIN authentication was introduced.

Either there is some kind of misunderstanding here or, for some yet unknown reason, some people seem to require an extra step at login.

For fun, I just tried registering as a new user via GOV.UK Verify, to see how far I could get. Still no go for me!

[stockton]

I suspect that if you have any problem getting your PIN, these extra steps are likely to be required.

[Gengulphus]

Obviously you do! I doubt if HMRC would accept, or could elicit, an anonymous tax return.

Again, I have never been asked to submit identification. I furnish personal details on my tax return, obviously. ...

Your personal details are identification, obviously: they identify you. What I presume you mean is that you have never been asked to submit additional, harder-for-someone-else-to-obtain identification, such as a certified copy of your driving license or passport.

Gengulphus

[XFool]

I suspect that if you have any problem getting your PIN, these extra steps are likely to be required.

Possibly so. Just to point out, in case some people don't know, either a mobile or a landline phone can be used. You can then choose, at login, which you want used each time.

[Lootman]

Again, I have never been asked to submit identification. I furnish personal details on my tax return, obviously. ...

Your personal details are identification, obviously: they identify you. What I presume you mean is that you have never been asked to submit additional, harder-for-someone-else-to-obtain identification, such as a certified copy of your driving license or passport.

Correct, I submit identifying information without any evidence or proof that it is true, which I believe was being asserted as not possible.

If anyone at the tax office bothered to cross-check the information I provide (name, address, date of birth etc.) with other sources of information available to the authorities, it would all tally.

[XFool]

Your personal details are identification, obviously: they identify you. What I presume you mean is that you have never been asked to submit additional, harder-for-someone-else-to-obtain identification, such as a certified copy of your driving license or passport.

Correct, I submit identifying information without any evidence or proof that it is true, which I believe was being asserted as not possible.

If anyone at the tax office bothered to cross-check the information I provide (name, address, date of birth etc.) with other sources of information available to the authorities, it would all tally.

So, to sum up (whew!): You do indeed provide valid identification.

[Lootman]

Correct, I submit identifying information without any evidence or proof that it is true, which I believe was being asserted as not possible.

If anyone at the tax office bothered to cross-check the information I provide (name, address, date of birth etc.) with other sources of information available to the authorities, it would all tally.

So, to sum up (whew!): You do indeed provide valid identification.

No, the distinction G and I were making is between self-reported identifying information and evidence/proof of identity.

The former is required (at least if you want to receive a refund cheque) but the latter is not.

Or put another way HMRC accepts self-reported identification information at face value without requiring validation or verification.

[XFool]

So, to sum up (whew!): You do indeed provide valid identification.

No, the distinction G and I were making is between self-reported identifying information and evidence/proof of identity.

The former is required (at least if you want to receive a refund cheque) but the latter is not.

Or put another way HMRC accepts self-reported identification information at face value without requiring validation or verification.

OK. Although, if they pay you a refund, it must go to either your bank account or your address. Or do I recall you use a PO Box? Would HMRC accept that?

[Lootman]

No, the distinction G and I were making is between self-reported identifying information and evidence/proof of identity.

The former is required (at least if you want to receive a refund cheque) but the latter is not.

Or put another way HMRC accepts self-reported identification information at face value without requiring validation or verification.

OK. Although, if they pay you a refund, it must go to either your bank account or your address. Or do I recall you use a PO Box? Would HMRC accept that?

Obviously you need to provide enough information to allow for cross-checking of data (to the extent that HMRC do that) and of course an address for a refund cheque. In the case of the latter I never get one because I have no tax withheld (other than some foreign withholding) and so I always owe. I guess HMRC could record my bank details from my cheque if they were that fussed. Or I could send them a postal order or bank draft if it bothered me.

HMRC accepts a postal address that is different from your residential address.

But my point was that I have never been asked for the kind of proof of identity that you need when, say, opening a bank account. No passport, driving license, utility bill, photo etc. And I have been doing SA returns since the 1990s.

[XFool]

But my point was that I have never been asked for the kind of proof of identity...

Actually, ultimately, there is no absolute "proof of identity", AFAICS. If you think about it.

The usual 'ultimate' ID verification seems to be a passport. To get one you need to supply a birth certificate. But, as I once ranted about on TMF, when I tried to apply for a cash ISA at my local Halifax/HBOS many years ago, the branch wouldn't even accept my original birth certificate! So, where do you go from there?

And anyone CAN apply for a birth certificate, I once applied for one on behalf of somebody I knew. No problem! This idea was, of course, the basis of the opening scene from the 1970s film: The Day of The Jackal.

[Gengulphus]

So, to sum up (whew!): You do indeed provide valid identification.

No, the distinction G and I were making is between self-reported identifying information and evidence/proof of identity.

Yes, I drew that distinction, but I also said that both of them are identification. And I'll add now that (assuming the information you give is true, of course) both of them are valid identification - the difference between them lies in how verifiable it is that they correctly identify you and not someone else (or indeed nobody at all).

And what XFool said earlier and appears to me to have led to this exchange was "I doubt if HMRC would accept, or could elicit, an anonymous tax return". There's no assertion in that about anything not being possible for the person submitting a tax return - it's all about what HMRC would do. (Of course, it's possible that I've failed to spot the remark you were trying to refer to when you said "which I believe was being asserted as not possible" - if so, please indicate just what you were referring to.)

Gengulphus

[Lootman]

what XFool said earlier and appears to me to have led to this exchange was "I doubt if HMRC would accept, or could elicit, an anonymous tax return". There's no assertion in that about anything not being possible for the person submitting a tax return - it's all about what HMRC would do. (Of course, it's possible that I've failed to spot the remark you were trying to refer to when you said "which I believe was being asserted as not possible" - if so, please indicate just what you were referring to.)

Xfool's idea of an anonymous tax return doesn't really make any sense. Nobody is going to submit a return and leave blank things like name, address, national insurance number (*) and so on. So it didn't really strike me as a concept worthy of consideration.

In the context of the foregoing discussion the only meaningful distinction I could see is between HMRC accepting your self-reported identifying information at face value and them requiring independent, documentary proof of your identity.

And to the extent that anyone was claiming that you have to prove your identity to HMRC, then I am living proof that you do not. That said I do not use any gateway nor do I have an online account. If extra verification steps are needed for that then I would not know. But those are optional anyway.

My interaction with HMRC is that once a year I post them my tax return with a cheque, and that is it for another year. Seems to work just fine. At least for my circumstances I never have any need for an online account, let alone to log into one. Old school still works, for now anyway, and presumably will continue to given that there will always be people with no internet, devices etc.

(*) I assume that a NIN is not mandatory as there could be foreign nationals who have UK income on which they owe tax, but they would not have a NIN.

[JohnB]

When I posted to the HMRC forum, I got this answer 10 days later. The idea that my mother will be fined for no fault of her own is outrageous.

Hi I can only apologise about the service that you have received. HMRC have added an extra layer of security to online accounts to cut down on fraudulent activity. If your mother has no passport and is not able to answer the credit check questions in place then she has the opportunity to use the GOV.UK verify service which is available online at Personal-tax-account .Choose the green start now button then ‘sign in with GOV.UK verify’. If you are unable to log in using this option, then unfortunately you will not be able to access the online service at this time. The return can be completed by paper or by using 3rd party software. If you opt to complete the return by paper unfortunately there is nothing HMRC can do to stop a late filing penalty being charged to the record. However, due to the circumstances, you will have the opportunity to appeal any penalties charged. Our appeals department would look into the possibility of removing these. Again, I can only apologise about your previous experience. If you would still like to raise a complaint you can do so online at www.gov.uk/complain-about-hmrc or in writing by sending your complaint to PAYE & Self-Assessment Complaints, HM Revenue & Customs, BX9 1AB Thank you

[stockton]

I had to appeal (because I believe that my return was made on time) and the appeal was accepted without argument.

[XFool]

When I posted to the HMRC forum, I got this answer 10 days later. The idea that my mother will be fined for no fault of her own is outrageous.

HMRC have added an extra layer of security to online accounts to cut down on fraudulent activity.

We still don't seem to know when and why this "extra layer of security" is used. Age based? Login errors? Non-UK passport? Foreign residence?