The GOV.UK One Login platform, used by around 23 million people to access services including DWP, HMRC and DVLA, will introduce a new identity verification option in 2027 that lets users prove who they are by securely logging into their bank account.
The update was confirmed by Stephanie Peacock, a minister at the Department for Digital, Culture, Media and Sport, in a written response to a parliamentary question from Devon MP Martin Wrigley. Peacock said the new option would launch next year, and that the government is also working with DWP to extend the use of benefit information for identity checks beyond Personal Independence Payment (PIP) to a wider range of benefits.
Expanding Identity Options
Peacock said: "Government is committed to ensuring GOV.UK One Login is accessible as possible, while protecting users and the government from the risks of fraud. GOV.UK One Login offers multiple ways for users to prove their identity: through the app, online security questions or in-person via the Post Office."
She added: "We are expanding the ways people can prove their identity, including a new option launching next year that will enable users to prove their identity by securely logging into their bank account. People receiving Personal Independence Payment (PIP) can already use information about their benefit to help prove their identity. We are working with DWP to extend this to a wider range of benefits. Where users cannot or choose not to use GOV.UK One Login, government services are required to provide alternative routes."
Security Concerns Raised
Senior Tory MP David Davis has been a vocal critic of the scheme, previously warning that One Login is "scandalously insecure". During a Westminster Hall debate last year, he described the single log-in system as a "strategic weakness", adding that the government's management of it had been a "disaster".
Davis, a civil liberties campaigner, warned that the system would leave every British citizen vulnerable to hackers and criminals, and suggested it could prove more damaging than the Horizon scandal, which saw postmasters across the UK wrongfully imprisoned due to catastrophic IT errors. He said: "As early as 2022, the information assurance team responsible for ensuring the security of the system raised concerns that it was being developed on unsecured workstations, by contractors in Romania who did not have security clearance. When it ran a red-team operation to see how secure it was, they broke into the system easily. They would have been able to install malware, and they were not even detected by the people running the system."
He added: "What will happen when this system comes into effect is that the entire population's entire data will be open to malevolent actors-foreign nations, ransomware criminals, malevolent hackers and even their own personal or political enemies. As a result, this will be worse than the Horizon scandal."
During the same debate, Iqbal Mohamed MP stated that the country had been "crying out for joined-up government for decades", but cautioned: "My constituents and millions across this country are opposed to the scheme because they see the breach of their civil liberties but do not see the benefits of the scheme."
Government Response and Passkeys
In response to criticisms, the government highlighted that the platform hosts dozens of services and is already being used by millions of people. A spokesperson said at the time: "One Login follows the highest security standards used across government and the private sector and is fully compliant with UK data protection and privacy laws. The system undergoes regular security reviews and testing, including by independent third-parties, to ensure security remains strong and up to date."
The government announced in September that passkeys were being rolled out across One Login. Officials say these allow people to log in securely using their PIN, Face ID or fingerprint rather than having to type in or remember a password. The government says that passkey logins are up to 8 times faster than signing in with username, password and 2-step verification code, and that passkeys can help protect people from phishing and other cyber threats.
In September, Jonathon Ellison, NCSC Director for National Resilience, said: "The introduction of passkeys for GOV.UK One Login will give users a faster, simpler and more secure way to sign in to many public-facing government services while leaving password headaches behind. Cyber criminals often look for the easiest route to access important accounts, which means login details remain a common target. But passkeys offer a highly phishing-resistant alternative to passwords, frustrating attackers and saving the public time.
"We strongly encourage users to set up a passkey for GOV.UK One Login and to do so wherever passkeys are available across digital services. By taking this small but significant step, you can help protect your online accounts and raise our collective resilience, making the UK safer."
