Know Your Customer (KYC): Online Identity Verification for Government services
The problem
Users of the UK Government online services need to prove their identity for claiming benefits, managing their taxes, or managing their information.
In the past, the users needed to make appointments and go with their documents to a jobcentre or receive a code by postal mail, with all the delays, extra time and costs that it involved.
In 2013, Verify was started as a service to allow users to verify their identity online.
Because of Verify’s low performance, HM Revenue & Customs decided, in 2017, to create its Identity Verification (IV) solution.
To comply with my non-disclosure agreement, I have omitted and obfuscated confidential information in this case study. All information in this case study is my own and does not necessarily reflect HM Revenue & Customs’ views.
My role
I joined the team in February 2019 and led a multi-functional design team (2 UX designers, one content designer and one researcher).
We designed an accessible online Identity Verification service for HMRC’s Government Gateway to allow users to request and use Government services.
We were involved with multiple HMRC teams and other Government departments, such as the Department for Work and Pensions (DWP), to implement our identity verification service as part of Universal Credits.
Our service was critical during the pandemic to allow users to get Government COVID support.
Touching ground
My first task was talking to the heads of the project. After talking to them, it was clear that they needed a service that was:
- Accessible: As a public service, accessibility lies in its core
- Secure: In line with the Government best practices.
- Reusable: Other services throughout the Government wanted to implement it as part of their journeys
Then I went through the latest research with the team, extracted the user need, reviewed the existing service and decided to update the prototype to align it with the Government Design System (GDS) and improve accessibility; and plan a usability testing round with users to get first-hand feedback every two weeks.
In the meantime, we visited the customer service team to understand the main reasons users reached them and agreed on a monthly report.
I also talked to the fraud and security teams to understand the security issues they had identified so far and listen to their ideas on how to solve them.
As a newcomer to the Identity Verification field, I also reviewed other existing solutions and read all the documentation I could find about the subject inside and outside Government.
After this work was done and we had a better understanding of the problem, I moderated a workshop with all the people mentioned above using the user needs as a conductor to brainstorm ideas.
Designing a secure service
The fraud team had identified some problems with the existing solution, and those needed to be addressed to stop fraudsters from making false claims.
After talking to the security team and reading the guidance available, it was clear that the existing service wasn’t in line with the industry standards.
We extracted the user needs from previous research and ran a workshop with the broader team, including developers, business analysts, product owners, customer service representatives and other services designers.
One of the workshop goals was to brainstorm ideas about improving security. We came out with a prioritised list of ideas to enhance security. The prefered one among the participants was cross-referencing the users’ identity with multiple sources instead of just one, as was the case.
I sketched five potential ideas with the design team and shortlisted three to be prototyped and tested.
After the first round of testing, it was clear that this solution would impact success rates. We needed to find ways to mitigate it by streamlining the identity matching and making the service more inclusive by increasing the available sources to cross-reference.
Streamlining the identity matching
The Identity Verification has two parts: a first one where we find the record of the database matching the user, and a second part where the user is requested to provide information about two different documents (Passport, driving licence, tax payments, benefits, etc.), that list is dynamic depending on the information available on the user.
The existing service allowed to get this initial matching in two ways:
- Using the full name, National Insurance Number (NIN) and date of birth
- Using a full name, a date of birth and an address
We used the analytics data to identify the NIN route as the most used one and fleshed it out.
One of the main findings was that we didn’t need to ask the full name, and it aligned with the user feedback. Users considered that the NIN and the date of birth should be enough.
Using that information, we wireframed a couple of ideas prioritising the most used route, and we also reduced the amount of data needed from the users.
A more inclusive solution
Because of the security enhancements, we were aware that some user groups couldn’t be cross-checked using the existing sources of information.
From the previous research done by the team, I identified the top 3 user groups that would struggle with the service:
- Self-employed
- Foreign nationals
- Young adults
For self-employed and foreign nationals, we did individual interviews with five users from each group to understand their challenges with the existing service and what could be done to improve their experience.
We found out that self-employed users had a reduced amount of sources to be asked about and that we needed to include self-assessment payment questions for this type of users as they could find this information in their online banking.
The challenge was about the service relying entirely on UK passport as the official document to identify users for foreign nationals.
These users required the possibility of using non-UK passports. We added it to the backlog for future exploration due to the size of the task.
The third group: young adults, was still being researched by the time I left the project. This user group issue was that most of them didn’t have a tax or credit history to check. We considered some options; the birth certificate was promising but was deemed not-secure enough after a security assessment.
All these users wanted the possibility of using the driver’s licence, so we worked with the Driver and Vehicle Licensing Agency to add it as another official document users could select.
Creating a reusable service
We worked very closely with other designers in Government to create a “plug and play” identity verification solution that could be quickly implemented and customised by their services.
By the time I left the project, more than 30 Government services had implemented our solution. Among them are the Department for Work and Pensions as part of Universal Credits and Self Assessment as part of their registration process.
We accomplished it by:
- Peer reviews involving designers working on services that needed to verify their users’ identities
- Regular demos of the prototype to the design community to collect their feedback
- Creating a prototype easy to integrate with other prototypes, so designers could save time when prototyping and testing their services.
The feedback collected helped us refine the customisation options needed by these services and get a view of the end to end journeys with different user types.
DWP Confirm your identity service for Universal Credits claims
- Universal Credit claims needed the users to make an appointment at the jobcentre.
- Before implementing Government Gateway, Universal Credits used GOV.UK Verify and 39% of claimants were able to identify themselves online.
- After implementing it, 52% of claimants were able to identify online reusing their HMRC Government Gateway account.
Implement our IV service as part of the Self Assessment registration in 2020
- Before, Self Assessment verified users trying to register for the first time by sending a letter with an activation code to their address, which could take up to 10 days.
- We worked closely with the different HMRC teams involved in the whole end to end journey: Self Assessment, the Business Tax Account and the Personal Tax Account teams, mapping user journeys, collaborating with the various stakeholders in the design solutions using a mix of workshops, prototyping, peer reviews, regular usability testing and demos.
- After implementing our solution, there was an increment in user satisfaction (112% for BTA users; 78% for PTA users), with up to 71% of users completing their SA registration after identifying online.
Building an accessible service
As part of the initial service assessment by the team, we flagged a few accessibility issues in the service.
I created a new prototype fixing them, got it peer-reviewed by an accessibility expert. They also reviewed the new prototypes for the increased security I and updated it with their feedback.
We tested the prototypes with a group of users with different access needs and got incredibly positive feedback as the online verification service would help them to do all the process on their own (the existing offline methods forced them to ask friends and family for help, mainly where there was a paper-based solution such as the pin in the post or paper forms)
We then requested an accessibility assessment form a panel of experts to flag any potential issues we may have missed. They provided us with a report, and we updated the service accordingly.
After this initial push, we regularly planned usability testing recruiting users with access needs.
