Online identity verification

You can opt to include an identification check for your users, if it’s necessary for your service. This allows you to verify that your users are who they say they are.

An identity check can be requested at any point in your service’s user journey.

While our initial service uses photo ID and facial matching to verify a user’s identity, alternative routes are being added, starting with knowledge-based verification. Knowledge based verification involves asking a series of questions that only the individual user would know the answers to.

The Scottish Government Identity Management and Privacy Principles

While ScotAccount verifies your user’s identity and shares the outcome of this check with you, you must still determine what information you need to hold for your user and what your user can see and do. This is line with the Scottish Government Identity Management and Privacy Principles.

In practice, this means:

• we will only send your user’s verified data to you when the user consents to their data being shared
• you need to retain only the information you deem necessary for providing your service to your user

Because we follow current privacy principles, ScotAccount enables your service to verify identity:

• without collecting unnecessary information, e.g. copies of documents
• while promoting an ethical, privacy-first approach that ensures data minimisation
• while meeting a GPG 45 medium confidence level

How your service will allow your user to verify their identity using ScotAccount

Step 1 - your service asks ScotAccount to verify the identity of your user and your user consents

You can include your own reference in this request.

Step 2 - your user submits their details

ScotAccount checks the identity being verified exists, and the identity has no indicators of fraud.

Step 3 - your user is prompted by ScotAccount screens to submit images of their ID and their face

ScotAccount checks a user’s ID is genuine and that they are actively using the ScotAccount service.

Step 4  - ScotAccount returns your user to your service with the result of their identity check – verified or unverified

• If a user has been verified, ScotAccount provides your user’s verified details -their name, date of birth and address 
• ScotAccount will also return any reference you have included in your request