The Government has confirmed that users of GOV.UK One Login will soon be able to prove their identity by securely logging into their bank account, with the new option launching next year. The platform, used by around 23 million people in the UK, provides access to services including DWP for state pension and benefits, HMRC for tax records and National Insurance information, DVLA driving licence renewals, and childcare provision.
Minister outlines expansion of identity options
Speaking on Friday in response to an enquiry from Devon MP Martin Wrigley, Stephanie Peacock, a minister in the Department for Digital, Culture, Media and Sport (DCMS), stated: "Government is committed to ensuring GOV.UK One Login is accessible as possible, while protecting users and the government from the risks of fraud. GOV.UK One Login offers multiple ways for users to prove their identity: through the app, online security questions or in-person via the Post Office."
She then outlined the upcoming changes: "We are expanding the ways people can prove their identity, including a new option launching next year that will enable users to prove their identity by securely logging into their bank account."
Peacock also noted that people receiving Personal Independence Payment (PIP) can already use information about their benefit to help prove their identity, and that the department is working with DWP to extend this to a wider range of benefits. Where users cannot or choose not to use GOV.UK One Login, government services are required to provide alternative routes.
Benefits already supported and security concerns
The DWP revealed in May that the platform could be used for issues around several benefits. At the time, it stated: "You can now get proof of your DWP benefits or State Pension online." Claimants were advised they could download a benefits letter to their device, or request a printed copy through the post. One Login can be used for benefits including the State Pension, adult DLA, JSA, Attendance Allowance, Pension Credit, Income Support, and ESA.
Concerns have been raised by senior MPs that the scheme could be susceptible to hackers. Veteran Tory MP David Davis has previously branded One Login as "scandalously insecure". During a Westminster Hall debate towards the end of last year, he described the single log-in system as a "strategic weakness", condemning the government's management of it as a "disaster".
Davis warned that the system would leave every Brit vulnerable to 'malevolent actors', including hackers and criminals. He said: "As early as 2022, the information assurance team responsible for ensuring the security of the system raised concerns that it was being developed on unsecured workstations, by contractors in Romania who did not have security clearance. When it ran a red-team operation to see how secure it was, they broke into the system easily. They would have been able to install malware, and they were not even detected by the people running the system."
He added: "What will happen when this system comes into effect is that the entire population's entire data will be open to malevolent actors-foreign nations, ransomware criminals, malevolent hackers and even their own personal or political enemies. As a result, this will be worse than the Horizon scandal."
Government defends security and passkeys
The government has dismissed this analysis, stating the system will provide Brits with a straightforward, so-called one-stop shop for accessing government services. During the same debate, Iqbal Mohamed MP declared that the country had been "crying out for joined-up government for decades", but said: "My constituents and millions across this country are opposed to the scheme because they see the breach of their civil liberties but do not see the benefits of the scheme."
In response to these criticisms, the government said the platform hosts dozens of services and is already being used by millions. A spokesperson said at the time: "One Login follows the highest security standards used across government and the private sector and is fully compliant with UK data protection and privacy laws. The system undergoes regular security reviews and testing, including by independent third-parties, to ensure security remains strong and up to date."
The Government revealed in September that passkeys were being introduced across One Login. Ministers say these allow individuals to log in securely using their PIN, Face ID or fingerprint instead of typing in or remembering a password. The Government says that passkey logins are up to eight times quicker than signing in with username, password and two-step verification code, and officials say that passkeys can help safeguard people from phishing and other cyber threats.
Speaking in September, Jonathon Ellison, NCSC Director for National Resilience, said: "The introduction of passkeys for GOV.UK One Login will give users a faster, simpler and more secure way to sign in to many public-facing government services while leaving password headaches behind. Cyber criminals often look for the easiest route to access important accounts, which means login details remain a common target. But passkeys offer a highly phishing-resistant alternative to passwords, frustrating attackers and saving the public time. We strongly encourage users to set up a passkey for GOV.UK One Login and to do so wherever passkeys are available across digital services. By taking this small but significant step, you can help protect your online accounts and raise our collective resilience, making the UK safer."
